[go: up one dir, main page]

US8074115B2 - Methods, media and systems for detecting anomalous program executions - Google Patents

Methods, media and systems for detecting anomalous program executions Download PDF

Info

Publication number
US8074115B2
US8074115B2 US12/091,150 US9115006A US8074115B2 US 8074115 B2 US8074115 B2 US 8074115B2 US 9115006 A US9115006 A US 9115006A US 8074115 B2 US8074115 B2 US 8074115B2
Authority
US
United States
Prior art keywords
program
model
anomalous
function call
application
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US12/091,150
Other languages
English (en)
Other versions
US20100023810A1 (en
Inventor
Salvatore J. Stolfo
Angelos D. Keromytis
Stelios Sidiroglou
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Columbia University in the City of New York
Original Assignee
Columbia University in the City of New York
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
US case filed in Virginia Eastern District Court litigation Critical https://portal.unifiedpatents.com/litigation/Virginia%20Eastern%20District%20Court/case/3%3A13-cv-00808 Source: District Court Jurisdiction: Virginia Eastern District Court "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
US case filed in Court of Appeals for the Federal Circuit litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/2016-2630 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
PTAB case IPR2015-00375 filed (Final Written Decision) litigation https://portal.unifiedpatents.com/ptab/case/IPR2015-00375 Petitioner: "Unified Patents PTAB Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
US case filed in Court of Appeals for the Federal Circuit litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/24-1243 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
First worldwide family litigation filed litigation https://patents.darts-ip.com/?family=37968513&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=US8074115(B2) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
US case filed in Court of Appeals for the Federal Circuit litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/2015-1146 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
US case filed in Court of Appeals for the Federal Circuit litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/2016-2551 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Columbia University in the City of New York filed Critical Columbia University in the City of New York
Priority to US12/091,150 priority Critical patent/US8074115B2/en
Assigned to THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK reassignment THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: SIDIROGLOU, STYLIANOS, KEROMYTIS, ANGELOS D, STOLFO, SALVATORE J
Publication of US20100023810A1 publication Critical patent/US20100023810A1/en
Application granted granted Critical
Publication of US8074115B2 publication Critical patent/US8074115B2/en
Assigned to NATIONAL SCIENCE FOUNDATION reassignment NATIONAL SCIENCE FOUNDATION CONFIRMATORY LICENSE (SEE DOCUMENT FOR DETAILS). Assignors: COLUMBIA UNIVERSITY
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0766Error or fault reporting or storing
    • G06F11/0772Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/36Prevention of errors by analysis, debugging or testing of software
    • G06F11/362Debugging of software
    • G06F11/3648Debugging of software using additional hardware
    • G06F11/3652Debugging of software using additional hardware in-circuit-emulation [ICE] arrangements
    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0718Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in an object-oriented system
    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751Error or fault detection not based on redundancy
    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/079Root cause analysis, i.e. error or fault diagnosis

Definitions

  • the disclosed subject matter relates to methods, media, and systems for detecting anomalous program executions.
  • methods, media, and systems for detecting anomalous program executions comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison.
  • computer-readable media containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions are provide, the method comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison.
  • systems for detecting anomalous program executions comprising: a digital processing device that: executes at least a part of a program in an emulator; compares a function call made in the emulator to a model of function calls for the at least a part of the program; and identifies the function call as anomalous based on the comparison.
  • methods for detecting anomalous program executions comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
  • computer-readable media containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions are provide, the method comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
  • systems for detecting anomalous program executions comprising: a digital processing device that: modifies a program to include indicators of program-level function calls being made during execution of the program; compares at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifies a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
  • FIG. 1 is a schematic diagram of an illustrative system suitable for implementation of an application that monitors other applications and protects these applications against faults in accordance with some embodiments;
  • FIG. 2 is a detailed example of the server and one of the workstations of FIG. 1 that may be used in accordance with some embodiments;
  • FIG. 3 shows a simplified diagram illustrating repairing faults in an application and updating the application in accordance with some embodiments
  • FIG. 5 shows an illustrative example of emulated code integrated into the code of an existing application in accordance with some embodiments
  • FIG. 6 shows a simplified diagram illustrating detecting and repairing an application using an application community in accordance with some embodiments of the disclosed subject matter
  • FIG. 7 shows an illustrative example of a table that may be calculated by a member of the application community for distributed bidding in accordance with some embodiments of the disclosed subject matter.
  • FIG. 8 shows a simplified diagram illustrating shows identifying a function call as being anomalous in accordance with some embodiments.
  • systems and methods for detecting anomalous program executions are provided.
  • systems and methods are provided that model application level computations and running programs, and that detect anomalous executions by, for example, instrumenting, monitoring and analyzing application-level program function calls and/or arguments.
  • Such an approach can be used to detect anomalous program executions that may be indicative of a malicious attack or program fault.
  • the anomaly detection algorithm being used may be, for example, a probabilistic anomaly detection (PAD) algorithm or a one class support vector machine (OCSVM), which are described below, or any other suitable algorithm.
  • PID probabilistic anomaly detection
  • OCSVM one class support vector machine
  • Anomaly detection may be applied to process execution anomaly detection, file system access anomaly detection, and/or network packet header anomaly detection.
  • an anomaly detector may be applied to program execution state information.
  • an anomaly detector may model information on the program stack to detect anomalous program behavior.
  • stack information may be extracted using, for example, Selective Transactional EMulation (STEM), which is described below and which permits the selective execution of certain parts, or all, of a program inside an instruction-level emulator, using the Valgrind emulator, by modifying a program's binary or source code to include indicators of what functions calls are being made (and any other suitable related information), or using any other suitable technique.
  • STEM Selective Transactional EMulation
  • one or more of the following may be extracted from the program stack specific information: function name, the argument buffer name it may reference, and other features associated with the data sent to or returned from the called function (e.g., the length in bytes of the data, or the memory location of the data).
  • an anomaly detector may be applied, for example, by extracting data pushed onto the stack (e.g., by using an emulator or by modifying a program), and creating a data record provided to the anomaly detector for processing at 802 .
  • an anomaly detector models normal program execution stack behavior.
  • the anomaly detector can detect stacked function references as anomalous at 806 by comparing those references to the model based on the training data at 804 .
  • selective transactional emulation (STEM) and error virtualization may be used to reverse (undo) the effects of processing the malicious input (e.g., changes to program variables or the file system) in order to allow the program to recover execution in a graceful manner.
  • STEM selective transactional emulation
  • error virtualization may be used to reverse (undo) the effects of processing the malicious input (e.g., changes to program variables or the file system) in order to allow the program to recover execution in a graceful manner.
  • the precise location of the failed (or attacked) program at which an anomaly was found may be identified.
  • the application of an anomaly detector to function calls can enable rapid detection of malicious program executions, such that it is possible to mitigate against such faults or attacks (e.g., by using patch generation systems, or content filtering signature generation systems).
  • the performance impact may be reduced by using STEM for parts or all of a program's execution.
  • anomaly detection can involve the use of detection models. These models can be used in connection with automatic and unsupervised learning.
  • a probabilistic anomaly detection (PAD) algorithm can be used to train a model for detecting anomalies.
  • This model may be, in essence, a density estimation, where the estimation of a density function p(x) over normal data allows the definition of anomalies as data elements that occur with low probability.
  • the detection of low probability data (or events) are represented as consistency checks over the normal data, where a record is labeled anomalous if it fails any one of these tests.
  • First and second order consistency checks can be applied.
  • First order consistency checks verify that a value is consistent with observed values of that feature in the normal data set. These first order checks compute the likelihood of an observation of a given feature, P(Xi), where Xi are the feature variables.
  • Second order consistency checks determine the conditional probability of a feature value given another feature value, denoted by P(Xi
  • N the total number of observations
  • Ni the number of observations of symbol i
  • the “pseudo count” that is added to the count of each observed symbol
  • k 0 the number of observed symbols
  • L the total number of possible symbols.
  • C can also be calculated by:
  • OCSVM one class SVM
  • the OCSVM algorithm can be used to map input data into a high dimensional feature space (via a kernel) and iteratively find the maximal margin hyperplane which best separates the training data from the origin.
  • the OCSVM may be viewed as a regular two-class SVM where all the training data lies in the first class, and the origin is taken as the only member of the second class.
  • the OCSVM can be used to solve an optimization problem to find the rule f with maximal geometric margin.
  • This classification rule can be used to assign a label to a test example x. If f(x) ⁇ 0, x can be labeled as an anomaly, otherwise it can be labeled as normal. In practice, there is a trade-off between maximizing the distance of the hyperplane from the origin and the number of training data points contained in the region separated from the origin by the hyperplane.
  • ⁇ i a lagrange multiplier (or “weight” on example i such that vectors associated with non-zero weights are called “support vectors” and solely determine the optimal hyperplane)
  • is a parameter that controls the trade-off between maximizing the distance of the hyperplane from the origin and the number of data points contained by the hyperplane
  • l is the number of points in the training dataset
  • K(x i , x j ) is the kernel function.
  • K ( x,y ) ⁇ ( x ), ⁇ ( y ) (10) Feature vectors need not be computed explicitly, and computational efficiency can be improved by directly computing kernel values K(x, y).
  • Three common kernels can be used:
  • “mimicry attacks” which might otherwise thwart OS system call level anomaly detectors by using normal appearing sequences of system calls can be detected. For example, mimicry attacks are less likely to be detected when the system calls are only modeled as tokens from an alphabet, without any information about arguments. Therefore, according to various embodiments, the models used are enriched with information about the arguments (data) such that it may be easier to detect mimicry attacks.
  • models are shared among many members of a community running the same application (referred to as an “application community”).
  • some embodiments can share models with each other and/or update each other's models such that the learning of anomaly detection models is relatively quick. For example, instead of running a particular application for days at a single site, according to various embodiments, thousands of replicated applications can be run for a short period of time (e.g., one hour), and the models created based on the distributed data can be shared. While only a portion of each application instance may be monitored, for example, the entire software body can be monitored across the entire community. This can enable the rapid acquisition of statistics, and relatively fast learning of an application profile by sharing, for example, aggregate information (rather than the actual raw data used to construct the model).
  • Model sharing can result in one standard model that an attacker could potentially access and use to craft a mimicry attack. Therefore, according to various embodiments, unique and diversified models can be created. For example, such unique and diversified models can be created by randomly choosing particular features from the application execution that is modeled, such that the various application instances compute distinct models. In this manner, attacks may need to avoid detection by multiple models, rather than just a single model. Creating unique and diversified models not only has the advantage of being more resistant to mimicry attacks, but also may be more efficient. For example, if only a portion of an application is modeled by each member of an application community, monitoring will generally be simpler (and cheaper) for each member of the community. In the event that one or more members of an application community are attacked, according to various embodiments, the attack (or fault) will be detected, and patches or a signature can be provided to those community members who are blind to the crafted attack (or fault).
  • Random (distinct) model building and random probing may be controlled by a software registration key provided by a commercial off-the-shelf (COTS) software vendor or some other data providing “randomization.” For example, for each member of an application community, some particular randomly chosen function or functions and its associated data may be chosen for modeling, while others may simply be ignored. Moreover, because vendors can generate distinct keys and serial numbers when distributing their software, this feature can be used to create a distinct random subset of functions to be modeled. Also, according to various embodiments, even community members who model the same function or functions may exchange models.
  • COTS commercial off-the-shelf
  • an application execution when an application execution is being analyzed over many copies distributed among a number of application community members to profile the entire code of an application, it can be determined whether there are any segments of code that are either rarely or never executed, and a map can be provided of the code layout identifying “suspect code segments” for deeper analysis and perhaps deeper monitoring. Those segments identified as rarely or never executed may harbor vulnerabilities not yet executed or exploited. Such segments of code may have been designed to execute only for very special purposes such as error handling, or perhaps even for triggering malicious code embedded in the application. Since they are rarely or never executed, one may presume that such code segments have had less regression testing, and may have a higher likelihood of harboring faulty code.
  • Identifying such code may be performed by a sensor that monitors loaded modules into the running application (e.g., DLL loads) as well as addresses (PC values) during code execution and creates a “frequency” map of ranges of the application code. For example, a set of such distributed sensors may communicate with each other (or through some site that correlates their collective information) to create a central, global MAP of the application execution profile. This profile may then be used to identify suspect code segments, and then subsequently, this information may be useful to assign different kinds of sensors/monitors to different code segments. For example, an interrupt service routine (ISR) may be applied to these suspect sections of code.
  • ISR interrupt service routine
  • a single application instance may have to be run many times (e.g., thousands of times) in order to compute an application profile or model.
  • distributed sensors whose data is correlated among many (e.g., a thousand) application community members can be used to compute a substantially accurate code profile in a relatively short amount of time. This time may be viewed as a “training period” to create the code map.
  • models may be automatically updated as time progresses. For example, although a single site may learn a particular model over some period of time, application behavior may change over time. In this case, the previously learned model may no longer accurately reflect the application characteristics, resulting in, for example, the generation of an excessive amount of false alarms (and thus an increase in the false positive rate over time).
  • a possible solution to this “concept drift” issue entails at least two possible approaches, both intended to update models over time.
  • a first approach to solving (or at least reducing the effects of) the “concept drift” issue involves the use of “incremental learning algorithms,” which are algorithms that piecemeal update their models with new data, and that may also “expire” parts of the computed model created by older data. This piecemeal incremental approach is intended to result in continuous updating using relatively small amounts of data seen by the learning system.
  • a second approach to solving (or at least reducing the effect of) the “concept drift” issue involves combining multiple models. For example, presuming that an older model has been computed from older data during some “training epoch,” a new model may be computed concurrently with a new epoch in which the old model is used to detect anomalous behavior. Once a new model is computed, the old model may be retired or expunged, and replaced by the new model. Alternatively, for example, multiple models such as described above may be combined. In this case, according to various embodiments, rather than expunging the old model, a newly created model can be algorithmically combined with the older model using any of a variety of suitable means.
  • an update may consist of an additive update of the frequency count table.
  • PAD may model data by computing the number of occurrences of a particular data item, “X.” Two independently learned PAD models can thus have two different counts for the same value, and a new frequency table can be readily computed by summing the two counts, essentially merging two tables and updating common values with the sum of their respective counts.
  • model updating that is readily achieved in the case of computed PAD models may be used in connection with model sharing.
  • two distinct models may be computed by two distinct instances of an application by two distinct devices, as described above.
  • the sharing of models may thus be implemented by the model update process described herein.
  • a device may continuously learn and update its models either by computing its own new model, or by downloading a model from another application community member (e.g., using the same means involved in the combining of models).
  • an application community may be configured to continuously refresh and update all community members, thereby making mimicry attacks far more difficult to achieve.
  • the patches and/or the set of all such patches may serve the following.
  • each patch may be used as a “pattern” to be used in searching other code for other unknown vulnerabilities.
  • An error (or design flaw) in programming that is made by a programmer and that creates a vulnerability may show up elsewhere in code. Therefore, once a vulnerability is detected, the system may use the detected vulnerability (and patch) to learn about other (e.g., similar) vulnerabilities, which may be patched in advance of those vulnerabilities being exploited. In this manner, over time, a system may automatically reduce (or eliminate) vulnerabilities.
  • previously generated patches may serve as exemplars for generating new patches.
  • a taxonomy of patches may be assembled that are related along various syntactic and semantic dimensions.
  • the generation of new patches may be aided by prior examples of patch generation.
  • generated patches may themselves have direct economic value. For example, once generated, patches may be “sold” back to the vendors of the software that has been patched.
  • STEM and error virtualization can be beneficial for reacting to detected failures/attacks in software.
  • STEM and error virtualization can be used to provide enhanced detection of some types of attacks, and enhanced reaction mechanisms to some types of attacks/failures.
  • a learning technique can be applied over multiple executions of a piece of code (e.g., a function or collection of functions) that may previously have been associated with a failure, or that is being proactively monitored. By retaining knowledge on program behavior across multiple executions, certain invariants (or probable invariants) may be learned, whose violation in future executions indicates an attack or imminent software fault.
  • a piece of code e.g., a function or collection of functions
  • control hijacking attacks certain control data that resides in memory is overwritten through some mechanism by an attacker. That control data is then used by the program for an internal operation, allowing the attacker to subvert the program.
  • Various forms of buffer overflow attacks (stack and heap smashing, jump into libc, etc.) operate in this fashion. Such attacks can be detected when the corrupted control data is about to be used by the program (i.e., after the attack has succeeded).
  • control data e.g., memory locations or registers that hold such data
  • data provided by the network which is potentially malicious
  • how data modifications propagate throughout program execution can be monitored by maintaining a memory bit for every byte or word in memory. This bit is set for a memory location when a machine instruction uses as input data that was provided as input to the program (e.g., was received over the network, and is thus possibly malicious) and produces output that is stored in this memory location. If a control instruction (such as a JUMP or CALL) uses as an argument a value in a memory location in which the bit is set (i.e., the memory location is “tainted”), the program or the supervisory code that monitors program behavior can recognize an anomaly and raises an exception.
  • a control instruction such as a JUMP or CALL
  • the inputs to the instruction(s) that can fail (or that can be exploited in an attack) and the outputs (results) of such instructions can be correlated with the inputs to the program at large.
  • Inputs to an instruction are registers or locations in memory that contain values that may have been derived (in full or partially) by the input to the program.
  • alternate inputs may be chosen to give to the instruction or the function (“input rewriting” or “input modification”) when an imminent failure is detected, thereby allowing the program to “sidestep” the failure.
  • micro-speculation e.g., as implemented by STEM
  • STEM can optionally be used to verify the effect of taking this course of action.
  • a recovery technique (with different input values or error virtualization, for example) can then be used.
  • the output of the instruction may be caused to be a value/result that is typically seen when executing the program (“output overloading”).
  • the values to use may be selected based on several different criteria, including but not limited to one or more of the following: the similarity of the program input that caused failure to other inputs that have not caused a failure; the most frequently seen input or output value for that instruction, based on contextual information (e.g., when particular sequence of functions are in the program call stack); and most frequently seen input or output value for that instruction across all executions of the instruction (in all contexts seen).
  • the DIVIDE instruction can be executed with a different denominator (e.g., based on how similar the program input is to other program inputs seen in the past, and the denominator values that these executions used).
  • the DIVIDE instruction may be treated as though it had given a particular division result. The program may then be allowed to continue executing, while its behavior is being monitored. Should a failure subsequently occur while still under monitoring, a different input or output value for the instruction can be used, for example, or a different repair technique can be used.
  • the user or administrator may be notified, program execution may be terminated, a rollback to a known good state (ignoring the current program execution) may take place, and/or some other corrective action may be taken.
  • the techniques used to learn typical data can be implemented as designer choice. For example, if it is assumed that the data modeled is 32-bit words, a probability distribution of this range of values can be estimated by sampling from multiple executions of the program.
  • various cluster-based analyses may partition the space of typical data into clusters that represent groups of similar/related data by some criteria.
  • Vector Quantization techniques representing common and similar data based on some “similarity” measure or criteria may also be compiled and used to guide modeling.
  • FIG. 1 is a schematic diagram of an illustrative system 100 suitable for implementation of various embodiments.
  • system 100 may include one or more workstations 102 .
  • Workstations 102 can be local to each other or remote from each other, and can be connected by one or more communications links 104 to a communications network 106 that is linked via a communications link 108 to a server 110 .
  • server 110 may be any suitable server for executing the application, such as a processor, a computer, a data processing device, or a combination of such devices.
  • Communications network 106 may be any suitable computer network including the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), or any combination of any of the same.
  • Communications links 104 and 108 may be any communications links suitable for communicating data between workstations 102 and server 110 , such as network links, dial-up links, wireless links, hard-wired links, etc.
  • Workstations 102 may be personal computers, laptop computers, mainframe computers, data displays, Internet browsers, personal digital assistants (PDAs), two-way pagers, wireless terminals, portable telephones, etc., or any combination of the same.
  • Workstations 102 and server 110 may be located at any suitable location. In one embodiment, workstations 102 and server 110 may be located within an organization. Alternatively, workstations 102 and server 110 may be distributed between multiple organizations.
  • workstation 102 may include digital processing device (such as a processor) 202 , display 204 , input device 206 , and memory 208 , which may be interconnected.
  • memory 208 contains a storage device for storing a workstation program for controlling processor 202 .
  • Memory 208 may also contain an application for detecting and repairing application from faults according to various embodiments. In some embodiments, the application may be resident in the memory of workstation 102 or server 110 .
  • Processor 202 may use the workstation program to present on display 204 the application and the data received through communication link 104 and commands and values transmitted by a user of workstation 102 . It should also be noted that data received through communication link 104 or any other communications links may be received from any suitable source, such as web services.
  • Input device 206 may be a computer keyboard, a cursor-controller, a dial, a switchbank, lever, or any other suitable input device as would be used by a designer of input systems or process control systems.
  • Server 110 may include processor 220 , display 222 , input device 224 , and memory 226 , which may be interconnected.
  • memory 226 contains a storage device for storing data received through communication link 108 or through other links, and also receives commands and values transmitted by one or more users.
  • the storage device can further contain a server program for controlling processor 220 .
  • a self-healing system that allows an application to automatically recover from software failures and attacks.
  • the system surrounds the detected fault to validate the operands to machine instructions, as appropriate for the type of fault.
  • the system emulates that portion of the application's code with a fix and updates the application. This increases service availability in the presence of general software bugs, software failures, attacks.
  • FIGS. 3 and 4 simplified flowcharts illustrating various steps performed in detecting faults in an application and fixing the application in accordance with some embodiments are provided. These are generalized flow charts. It will be understood that the steps shown in FIGS. 3 and 4 may be performed in any suitable order, some may be deleted, and others added.
  • process 300 begins by detecting various types of failures in one or more applications at 310 .
  • detecting for failures may include monitoring the one or more applications for failures, e.g., by using an anomaly detector as described herein.
  • the monitoring or detecting of failures may be performed using one or more sensors at 310 .
  • Failures include programming errors, exceptions, software faults (e.g., illegal memory accesses, division by zero, buffer overflow attacks, time-of-check-to-time-of-use (TOCTTOU) violations, etc.), threats (e.g., computer viruses, worms, trojans, hackers, key recovery attacks, malicious executables, probes, etc.), and any other suitable fault that may cause abnormal application termination or adversely affect the one or more applications.
  • software faults e.g., illegal memory accesses, division by zero, buffer overflow attacks, time-of-check-to-time-of-use (TOCTTOU) violations, etc.
  • threats e.g., computer viruses, worms, trojans, hackers, key recovery attacks, malicious executables, probes, etc.
  • any other suitable fault that may cause abnormal application termination or adversely affect the one or more applications.
  • Any suitable sensors may be used to detect failures or monitor the one or more applications.
  • anomaly detectors as described herein can be used.
  • feedback from the sensors may be used to predict which parts of a given application's code may be vulnerable to a particular class of attack (e.g., remotely exploitable buffer overflows).
  • the sensors may also detect that a fault has occurred. Upon predicting that a fault may occur or detecting that a fault has occurred, the portion of the application's code having the faulty instruction or vulnerable function can be isolated, thereby localizing predicted faults at 330 .
  • the one or more sensor may monitor the application until it is caused to abnormally terminate.
  • the system may detect that a fault has occurred, thereby causing the actual application to terminate.
  • the system forces a misbehaving application to abort.
  • the system In response to the application terminating, the system generates a core dump file or produces other failure-related information, at 420 .
  • the core dump file may include, for example, the type of failure and the stack trace when that failure occurred.
  • the system isolates the portion of the application's code that contains the faulty instruction at 430 .
  • the system may apply selective emulation to the isolated portion or slice of the application. For example, the system may start with the top-most function in the stack trace.
  • the system may generate an instrumented version of the application ( 340 ).
  • an instrumented version of the application may be a copy of a portion of the application's code or all of the application's code.
  • the system may observe instrumented portions of the application. These portions of the application may be selected based on vulnerability to a particular class of attack.
  • the instrumented application may be executed on the server that is currently running the one or more applications, a separate server, a workstation, or any other suitable device.
  • Isolating a portion of the application's code and using the emulator on the portion allows the system to reduce and/or minimize the performance impact on the immunized application.
  • this embodiment isolates a portion or a slice of the application's code, the entire application may also be emulated.
  • the emulator may be implemented completely in software, or may take advantage of hardware features of the system processor or architecture, or other facilities offered by the operating system to otherwise reduce and/or minimize the performance impact of monitoring and emulation, and to improve accuracy and effectiveness in handling failures.
  • An attempt to exploit such a vulnerability exposes the attack or input vector and other related information (e.g., attacked buffer, vulnerable function, stack trace, etc.).
  • the attack or input vector and other related information can then be used to construct an emulator-based vaccine or a fix that implements array bounds checking at the machine-instruction level at 350 , or other fixes as appropriate for the detected type of failure.
  • the vaccine can then be tested in the instrumented application using an instruction-level emulator (e.g., libtasvm x86 emulator, STEM x86 emulator, etc.) to determine whether the fault was fixed and whether any other functionality (e.g., critical functionality) has been impacted by the fix.
  • an instruction-level emulator e.g., libtasvm x86 emulator, STEM x86 emulator, etc.
  • the system can verify whether the specific fault has been repaired by running the instrumented application against the event sequence (e.g., input vectors) that caused the specific fault. For example, to verify the effectiveness of a fix, the application may be restarted in a test environment or a sandbox with the instrumentation enabled, and is supplied with the one or more input vectors that caused the failure.
  • a sandbox generally creates an environment in which there are strict limitations on which system resources the instrumented application or a function of the application may request or access.
  • the instruction-level emulator can be selectively invoked for segments of the application's code, thereby allowing the system to mix emulated and non-emulated code within the same code execution.
  • the emulator may be used to, for example, detect and/or monitor for a specific type of failure prior to executing the instruction, record memory modifications during the execution of the instruction (e.g., global variables, library-internal state, libc standard I/O structures, etc.) and the original values, revert the memory stack to its original state, and simulate an error return from a function of the application. That is, upon entering the vulnerable section of the application's code, the instruction-level emulator can capture and store the program state and processes all instructions, including function calls, inside the area designated for emulation.
  • the virtual processor copies its internal state back to the device processor registers. While registers are updated, memory updates are also applied through the execution of the emulation.
  • the program unaware of the instructions executed by the virtual processor, continues normal execution on the actual processor.
  • the instruction-level emulator may be linked with the application in advance. Alternatively, in response to a detected failure, the instruction-level emulator may be compiled in the code. In another suitable embodiment, the instruction-level emulator may be invoked in a manner similar to a modern debugger when a particular program instruction is executed. This can take advantage of breakpoint registers and/or other program debugging facilities that the system processor and architecture possess, or it can be a pure-software approach.
  • an emulator allows the system to detect and/or monitor a wide array of software failures, such as illegal memory dereferences, buffer overflows, and buffer underflows, and more generic faults, such as divisions by zero.
  • the emulator checks the operands of the instructions it is about to emulate using, at least partially, the vector and related information provided by the one or more sensors that detected the fault. For example, in the case of a division by zero, the emulator checks the value of the operand to the div instruction.
  • the emulator verifies whether the source and destination address of any memory access (or the program counter for instruction fetches) points to a page that is mapped to the process address space using the mincore( ) system call, or the appropriate facilities provided by the operating system.
  • the memory surrounding the vulnerable buffer, as identified by the one or more sensors is padded by one byte.
  • the emulator then watches for memory writes to these memory locations. This may require source code availability so as to insert particular variables (e.g., canary variables that launch themselves periodically and perform some typical user transaction to enable transaction-latency evaluation around the clock). The emulator can thus prevent the overflow before it overwrites the remaining locations in the memory stack and recovers the execution.
  • Other approaches for detecting these failures may be incorporated in the system in a modular way, without impacting the high-level operation and characteristics of the system.
  • the instruction-level emulator may be implemented as a statically-linked C library that defines special tags (e.g., a combination of macros and function calls) that mark the beginning and the end of selective emulation.
  • special tags e.g., a combination of macros and function calls
  • FIG. 5 An example of the tags that are placed around a segment of the application's code for emulation by the instruction-level emulator is shown in FIG. 5 .
  • the C macro emulate_init( ) moves the program state (general, segment, eflags, and FPU registers) into an emulator-accessible global data structure to capture state immediately before the emulator takes control.
  • the data structure can be used to initialize the virtual registers.
  • emulate_begin( ) obtains the memory location of the first instruction following the call to itself.
  • the instruction address may be the same as the return address and can be found in the activation record of emulate_begin( ), four bytes above its base stack pointer.
  • the fetch/decode/execute/retire cycle of instructions can continue until either emulate_end( ) is reached or when the emulator detects that control is returning to the parent function. If the emulator does not encounter an error during its execution, the emulator's instruction pointer references the emulate_term( ) macro at completion. To enable the instrumented application to continue execution at this address, the return address of the emulate_begin( ) activation record can be replaced with the current value of the instruction pointer. By executing emulate_term( ), the emulator's environment can be copied to the program registers and execution continues under normal conditions.
  • the emulator can be linked with the vulnerable application when the source code of the vulnerable application is available, in some embodiments the processor's programmable breakpoint register can be used to invoke the emulator without the running process even being able to detect that it is now running under an emulator.
  • the emulator can also simulate an error return from the function. For example, some embodiments may generate a map between a set of errors that may occur during an application's execution and a limited set of errors that are explicitly handled by the application's code (sometimes referred to herein as “error virtualization”). As described below, the error virtualization features may be based on heuristics. However, any suitable approach for determining the return values for a function may be used. For example, aggressive source code analysis techniques to determine the return values that are appropriate for a function may be used.
  • portions of code of specific functions can be marked as fail-safe and a specific value may be returned when an error return is forced (e.g., for code that checks user permissions).
  • the error value returned for a function that has failed can be determined using information provided by a programmer, system administrator, or any other suitable user.
  • error virtualization features allow an application to continue execution even though a boundary condition that was not originally predicted by a programmer allowed a fault to occur.
  • error virtualization features allows for the application's code to be retrofitted with an exception catching mechanism, for faults that were unanticipated by the programmer.
  • error virtualization is different from traditional exception handling as implemented by some programming languages, where the programmer must deliberately create exceptions in the program code and also add code to handle these exceptions. Under error virtualization, failures and exceptions that were unanticipated by, for example, the programmer can be caught, and existing application code can be used to handle them.
  • error virtualization can be implemented through the instruction-level emulator.
  • error virtualization may be implemented through additional source code that is inserted in the application's source code directly. This insertion of such additional source code can be performed automatically, following the detection of a failure or following the prediction of a failure as described above, or it may be done under the direction of a programmer, system operator, or other suitable user having access to the application's source code.
  • the system may return the program state to its original settings and force an error return from the currently executing function.
  • the system analyzes the declared type of function.
  • the system may analyze the declared type of function using, for example, a TXL script.
  • TXL is a hybrid function and rule-based language that may be used for performing source-to-source transformation and for rapidly prototyping new languages and language processors.
  • the system determines the appropriate error value and places it in the stack frame of the returning function. The appropriate error value may be determined based at least in part on heuristics.
  • the return error code may be determined using information embedded in the source code of the application, or through additional information provided to the system by the application programmer, system administrator or third party.
  • the emulate_end( ) is located and the emulation terminates. Because the emulator saved the state of the application before starting and kept track of memory modification during the application's execution, the system is capable of reversing any memory changes made by the code function inside which the fault occurred by returning it to its original setting, thereby nullifying the effect of the instructions processed through emulation. That is, the emulated portion of the code is sliced off and the execution of the code along with its side effects in terms of changes to memory have been rolled back.
  • the emulator may not be able to perform system calls directly without kernel-level permissions. Therefore, when the emulator decodes an interruption with an intermediate value of 0x80, the emulator releases control to the kernel. However, before the kernel executes the system call, the emulator can back-up the real registers and replace them with its own values. An INT 0x80 can be issued by the emulator and the kernel processes the system call. Once control returns to the emulator, the emulator can update its registers and restore the original values in the application's registers.
  • the system can then update the application based at least in part on the emulation.
  • artificial diversity features may be provided to mitigate the security risks of software monoculture.
  • FIG. 6 is a simplified flowchart illustrating the various steps performed in using an application community to monitor an application for faults and repair the application in accordance with some embodiments. This is a generalized flow chart. It will be understood that the steps shown in FIG. 6 may be performed in any suitable order, some may be deleted, and others added.
  • the system may divide an application's code into portions of code at 610 .
  • Each portion or slice of the application's code may, for example, be assigned to one of the members of the application community (e.g., workstation, server, etc.).
  • Each member of the application community may monitor the portion of the code for various types of failures at 620 .
  • failures include programming errors, exceptions, software faults (e.g., illegal memory accesses, division by zero, buffer overflow attacks, TOCTTOU violations, etc.), threats (e.g., computer viruses, worms, trojans, hackers, key recovery attacks, malicious executables, probes, etc.), and any other suitable fault that may cause abnormal application termination or adversely affect the one or more applications.
  • the system may divide the portions of code based on the size of the application and the number of members in the application community (i.e., size of the application/members in the application community).
  • the system may divide the portions of code based on the amount of available memory in each of the members of the application community. Any suitable approach for determining how to divide up the application's code may also be used. Some suitable approaches are described hereinafter.
  • the system may examine the total work in the application community, W, by examining the cost of executing discrete slices of the application's code. Assuming a set of functions, F, that comprise an application's callgraph, the i th member of F is denoted as f i .
  • the cost of executing each f i is a function of the amount of computation present in f i (i.e., x i ) and the amount of risk in f i (i.e., v i ).
  • the calculation of x i can be driven by at least two metrics: o i , the number of machine instructions executed as part of f i , and t i , the amount of time spent executing f i . Both o i and t i may vary as a function of time or application workload according to the application's internal logic. For example, an application may perform logging or cleanup duties after the application passes a threshold number of requests.
  • a cost function may be provided in two phases.
  • the first phase calculates the cost due to the amount of computation for each f i .
  • the system may account for the measure of a function's vulnerability. For example, the system treats v i as a discrete variable with a value of ⁇ , where ⁇ takes on a range of values according to the amount of risk such that:
  • v i ⁇ ⁇ ( if ⁇ ⁇ f i ⁇ ⁇ is ⁇ ⁇ vulnerable ) 1 ( if ⁇ ⁇ f i ⁇ ⁇ is ⁇ ⁇ not ⁇ ⁇ vulnerable )
  • the system may determine the total amount of work in the system and the total number of members needed for monitoring:
  • work units can be distributed.
  • a central controller or one of the workstations may assign each node approximately W/N work units.
  • each member of the application community may determine its own work set. Each member may iterate through the list of work units flipping a coin that is weighted with the value v i *r i . Therefore, if the result of the flip is “true,” then the member adds that work unit to its work set.
  • the system may generate a list having n*W slots.
  • Each function can be represented by a number of entries on the list (e.g., v i *r i ). Every member of the application community can iterate through the list, for example, by randomly selecting true or false. If true, the application community member monitors the function of the application for a given time slice. Because heavily weighted functions have more entries in the list, a greater number of users may be assigned to cover the application. The member may stop when its total work reaches W/N. Such an approach offers statistical coverage of the application.
  • a distributed bidding approach may be used to distribute the workload of monitoring and repairing an application.
  • Each node in the callgraph G has a weight v i *r i .
  • Some subset of the nodes in F is assigned to each application community member such that each member does no more work than W/N work.
  • the threshold can be relaxed to be within some range ⁇ of W/N, where ⁇ is a measure of system fairness.
  • each application community member may adjust its workload by bargaining with other members using a distributed bidding approach.
  • v i *r i may be greater than the average amount of work, W/N. Achieving fairness means that v i *r i defines the quantity of application community members that is assigned to it and the sum of these quantities defines the minimum number of members in the application community.
  • each application community member calculates a table.
  • An example of such a table is shown in FIG. 7 .
  • application community members may place bids to adjust each of their respective workloads.
  • the system may use tokens for bidding. Tokens may map directly to the number of time quanta that an application community member is responsible for monitoring a work unit or a function of an application. The system ensures that each node does not accumulate more than the total number of tokens allowed by the choice of ⁇ .
  • each application community member may predict that a fault may occur in the assigned portion of code or may detect that a fault has occurred causing the application to abort, where the assigned portion of the code was the source of the fault. As faults are detected, applications members may each proactively monitor assigned portions of code containing the fault to prevent the application from further failures. As discussed previously, the application community member may isolate the portion of the code that caused the fault and use the emulator to test vaccines or fixes. At 650 , the application community member that detects or predicts the fault may notify the other application community members. Other application members that have succumbed to the fault may be restarted with the protection mechanisms or fixes generated by the application member that detected the fault.
  • the probability of the application community detecting the fault is:
  • ⁇ i 1 N ⁇ 1 N , or N/N, a probability of 1 that the fault is detected when it first occurs.
  • a procedure is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. These steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. However, all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.
  • the manipulations performed are often referred to in terms, such as adding or comparing, which are commonly associated with mental operations performed by a human operator. No such capability of a human operator is necessary, or desirable in many cases, in any of the operations described herein in connection with various embodiments; the operations are machine operations.
  • Useful machines for performing the operation of various embodiments include general purpose digital computers or similar devices.
  • Some embodiments also provide apparatuses for performing these operations. These apparatuses may be specially constructed for the required purpose or it may comprise a general purpose computer as selectively activated or reconfigured by a computer program stored in the computer.
  • the procedures presented herein are not inherently related to a particular computer or other apparatus.
  • Various general purpose machines may be used with programs written in accordance with the teachings herein, or it may prove more convenient to construct more specialized apparatus to perform the described method. The required structure for a variety of these machines will appear from the description given.
  • Some embodiments may include a general purpose computer, or a specially programmed special purpose computer.
  • the user may interact with the system via e.g., a personal computer or over PDA, e.g., the Internet an Intranet, etc. Either of these may be implemented as a distributed computer system rather than a single computer.
  • the communications link may be a dedicated link, a modem over a POTS line, the Internet and/or any other method of communicating between computers and/or users.
  • the processing could be controlled by a software program on one or more computer systems or processors, or could even be partially or wholly implemented in hardware.
  • a single computer may be used, systems according to one or more embodiments are optionally suitably equipped with a multitude or combination of processors or storage devices.
  • the computer may be replaced by, or combined with, any suitable processing system operative in accordance with the concepts of various embodiments, including sophisticated calculators, hand held, laptop/notebook, mini, mainframe and super computers, as well as processing system network combinations of the same.
  • portions of the system may be provided in any appropriate electronic format, including, for example, provided over a communication line as electronic signals, provided on CD and/or DVD, provided on optical disk memory, etc.
  • Any presently available or future developed computer software language and/or hardware components can be employed in such embodiments.
  • at least some of the functionality mentioned above could be implemented using Visual Basic, C, C++ or any assembly language appropriate in view of the processor being used. It could also be written in an object oriented and/or interpretive environment such as Java and transported to multiple destinations to various users.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Debugging And Monitoring (AREA)
US12/091,150 2005-10-25 2006-10-25 Methods, media and systems for detecting anomalous program executions Active US8074115B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/091,150 US8074115B2 (en) 2005-10-25 2006-10-25 Methods, media and systems for detecting anomalous program executions

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US73028905P 2005-10-25 2005-10-25
PCT/US2006/041591 WO2007050667A2 (fr) 2005-10-25 2006-10-25 Procedes, supports et systemes de detection d'executions de programme anormales
US12/091,150 US8074115B2 (en) 2005-10-25 2006-10-25 Methods, media and systems for detecting anomalous program executions

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2006/041591 A-371-Of-International WO2007050667A2 (fr) 2005-10-25 2006-10-25 Procedes, supports et systemes de detection d'executions de programme anormales

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/301,741 Continuation US8601322B2 (en) 2005-10-25 2011-11-21 Methods, media, and systems for detecting anomalous program executions

Publications (2)

Publication Number Publication Date
US20100023810A1 US20100023810A1 (en) 2010-01-28
US8074115B2 true US8074115B2 (en) 2011-12-06

Family

ID=37968513

Family Applications (8)

Application Number Title Priority Date Filing Date
US12/091,150 Active US8074115B2 (en) 2005-10-25 2006-10-25 Methods, media and systems for detecting anomalous program executions
US13/301,741 Active US8601322B2 (en) 2005-10-25 2011-11-21 Methods, media, and systems for detecting anomalous program executions
US14/014,871 Abandoned US20140215276A1 (en) 2005-10-25 2013-08-30 Methods, media, and systems for detecting anomalous program executions
US15/014,784 Abandoned US20160246665A1 (en) 2005-10-25 2016-02-03 Methods, media and systems for detecting anomalous program executions
US16/175,424 Abandoned US20190250978A1 (en) 2005-10-25 2018-10-30 Methods, media, and systems for detecting anomalous program executions
US16/175,429 Abandoned US20190250979A1 (en) 2005-10-25 2018-10-30 Methods, media and systems for detecting anomalous program executions
US15/930,951 Abandoned US20210096941A1 (en) 2005-10-25 2020-05-13 Methods, media and systems for detecting anomalous program executions
US17/202,569 Abandoned US20220058077A1 (en) 2005-10-25 2021-03-16 Methods, media, and systems for detecting anomalous program executions

Family Applications After (7)

Application Number Title Priority Date Filing Date
US13/301,741 Active US8601322B2 (en) 2005-10-25 2011-11-21 Methods, media, and systems for detecting anomalous program executions
US14/014,871 Abandoned US20140215276A1 (en) 2005-10-25 2013-08-30 Methods, media, and systems for detecting anomalous program executions
US15/014,784 Abandoned US20160246665A1 (en) 2005-10-25 2016-02-03 Methods, media and systems for detecting anomalous program executions
US16/175,424 Abandoned US20190250978A1 (en) 2005-10-25 2018-10-30 Methods, media, and systems for detecting anomalous program executions
US16/175,429 Abandoned US20190250979A1 (en) 2005-10-25 2018-10-30 Methods, media and systems for detecting anomalous program executions
US15/930,951 Abandoned US20210096941A1 (en) 2005-10-25 2020-05-13 Methods, media and systems for detecting anomalous program executions
US17/202,569 Abandoned US20220058077A1 (en) 2005-10-25 2021-03-16 Methods, media, and systems for detecting anomalous program executions

Country Status (4)

Country Link
US (8) US8074115B2 (fr)
EP (1) EP1952240A2 (fr)
CA (1) CA2626993A1 (fr)
WO (1) WO2007050667A2 (fr)

Cited By (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080235001A1 (en) * 2007-03-22 2008-09-25 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Implementing emulation decisions in response to software evaluations or the like
US20100229173A1 (en) * 2009-03-04 2010-09-09 Vmware, Inc. Managing Latency Introduced by Virtualization
US20120151270A1 (en) * 2005-10-25 2012-06-14 Stolfo Salvatore J Methods, media, and systems for detecting anomalous program executions
US20130007883A1 (en) * 2011-06-28 2013-01-03 Kaspersky Lab Zao Portable Security Device and Methods for Detection and Treatment of Malware
US8407785B2 (en) 2005-08-18 2013-03-26 The Trustees Of Columbia University In The City Of New York Systems, methods, and media protecting a digital data processing device from attack
US8489931B2 (en) 2006-10-30 2013-07-16 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US8489925B1 (en) * 2012-11-09 2013-07-16 Kaspersky Lab, Zao System and method for processing of system errors
US8566928B2 (en) 2005-10-27 2013-10-22 Georgia Tech Research Corporation Method and system for detecting and responding to attacking networks
US8578497B2 (en) 2010-01-06 2013-11-05 Damballa, Inc. Method and system for detecting malware
US20130332442A1 (en) * 2012-06-06 2013-12-12 Microsoft Corporation Deep application crawling
US8631489B2 (en) 2011-02-01 2014-01-14 Damballa, Inc. Method and system for detecting malicious domain names at an upper DNS hierarchy
US20140172404A1 (en) * 2012-12-14 2014-06-19 Jasen Minov Evaluation of software applications
US8826438B2 (en) 2010-01-19 2014-09-02 Damballa, Inc. Method and system for network-based detecting of malware from behavioral clustering
WO2014152469A1 (fr) * 2013-03-18 2014-09-25 The Trustees Of Columbia University In The City Of New York Détection de logiciel malveillant reposant sur une anomalie non supervisée à l'aide de caractéristiques de matériel
US8949672B1 (en) * 2011-04-18 2015-02-03 Western Digital Technologies, Inc. Analyzing a dump file from a data storage device together with debug history to diagnose/resolve programming errors
US9166994B2 (en) 2012-08-31 2015-10-20 Damballa, Inc. Automation discovery to identify malicious activity
US9245110B2 (en) 2013-12-17 2016-01-26 International Business Machines Corporation Stack entry overwrite protection
US9378108B2 (en) 2007-03-22 2016-06-28 Invention Science Fund I, Llc Implementing performance-dependent transfer or execution decisions from service emulation indications
US20160274997A1 (en) * 2014-01-29 2016-09-22 Hewlett Packard Enterprise Development Lp End user monitoring to automate issue tracking
US9495541B2 (en) 2011-09-15 2016-11-15 The Trustees Of Columbia University In The City Of New York Detecting return-oriented programming payloads by evaluating data for a gadget address space address and determining whether operations associated with instructions beginning at the address indicate a return-oriented programming payload
US9516058B2 (en) 2010-08-10 2016-12-06 Damballa, Inc. Method and system for determining whether domain names are legitimate or malicious
US9558019B2 (en) 2007-03-22 2017-01-31 Invention Science Fund I, Llc Coordinating instances of a thread or other service in emulation
US9680861B2 (en) 2012-08-31 2017-06-13 Damballa, Inc. Historical analysis to identify malicious activity
US9894088B2 (en) 2012-08-31 2018-02-13 Damballa, Inc. Data mining to identify malicious activity
US9930065B2 (en) 2015-03-25 2018-03-27 University Of Georgia Research Foundation, Inc. Measuring, categorizing, and/or mitigating malware distribution paths
US10025929B2 (en) 2013-03-18 2018-07-17 The Trustees Of Columbia University In The City Of New York Detection of anomalous program execution using hardware-based micro-architectural data
US10027688B2 (en) 2008-08-11 2018-07-17 Damballa, Inc. Method and system for detecting malicious and/or botnet-related domain names
US10050986B2 (en) 2013-06-14 2018-08-14 Damballa, Inc. Systems and methods for traffic classification
US10084806B2 (en) 2012-08-31 2018-09-25 Damballa, Inc. Traffic simulation to identify malicious activity
US10089467B1 (en) 2017-05-23 2018-10-02 Malwarebytes Inc. Static anomaly-based detection of malware files
US20190121686A1 (en) * 2017-10-23 2019-04-25 Liebherr-Werk Nenzing Gmbh Method and system for evaluation of a faulty behaviour of at least one event data generating machine and/or monitoring the regular operation of at least one event data generating machine
US10394212B2 (en) * 2012-06-26 2019-08-27 Inter Control Hermann Kohler Elektrik Gmbh & Co. Kg Apparatus and method for a security-critical application
US10430591B1 (en) * 2016-10-04 2019-10-01 Bromium, Inc. Using threat model to monitor host execution in a virtualized environment
US10547674B2 (en) 2012-08-27 2020-01-28 Help/Systems, Llc Methods and systems for network flow analysis
US10992703B2 (en) 2019-03-04 2021-04-27 Malwarebytes Inc. Facet whitelisting in anomaly detection
US20220141669A1 (en) * 2020-10-30 2022-05-05 EXFO Solutions SAS SIM swap scam protection via passive monitoring
US20240378290A1 (en) * 2023-05-11 2024-11-14 International Business Machines Corporation Detecting a security bypass through binary code analysis

Families Citing this family (77)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8127413B2 (en) * 2006-07-11 2012-03-06 Georgia Tech Research Corporation System and method for preventing race condition vulnerability
US20080109804A1 (en) * 2006-11-06 2008-05-08 Richard Welcher Bloomstein Additional uses of virtualization for disaster recovery and prevention
US8312075B1 (en) * 2006-11-29 2012-11-13 Mcafee, Inc. System, method and computer program product for reconstructing data received by a computer in a manner that is independent of the computer
WO2008092162A2 (fr) * 2007-01-26 2008-07-31 The Trustees Of Columbia University In The City Of New York Systèmes, procédés et support pour récupérer une application après une défaillance ou une attaque
US20090271663A1 (en) * 2008-04-24 2009-10-29 Vining Robert G Providing detailed program state information for error analysis
WO2010076832A1 (fr) * 2008-12-31 2010-07-08 Telecom Italia S.P.A. Détection d'anomalie pour réseaux à base de paquets
US7603713B1 (en) * 2009-03-30 2009-10-13 Kaspersky Lab, Zao Method for accelerating hardware emulator used for malware detection and analysis
KR101493076B1 (ko) * 2009-04-07 2015-02-12 삼성전자 주식회사 버퍼 오버플로우 관리를 통한 바이러스 코드 실행방지장치 및 그 방법
KR101440299B1 (ko) * 2010-11-16 2014-09-17 한국전자통신연구원 자가 치유 시스템 및 그 방법
US8429744B1 (en) * 2010-12-15 2013-04-23 Symantec Corporation Systems and methods for detecting malformed arguments in a function by hooking a generic object
US8762790B2 (en) * 2011-09-07 2014-06-24 International Business Machines Corporation Enhanced dump data collection from hardware fail modes
US8700946B2 (en) * 2011-10-27 2014-04-15 Sungard Availability Services, Lp Dynamic resource allocation in recover to cloud sandbox
EP2802988A1 (fr) * 2012-01-10 2014-11-19 Telcordia Technologies, Inc. Diversité adaptative pour les programmes orientés retour (rop) compressibles
WO2014018029A1 (fr) * 2012-07-25 2014-01-30 Hewlett-Packard Development Company, L.P. Détermination des vulnérabilités d'une application
US9009535B2 (en) * 2012-08-16 2015-04-14 International Business Machines Corporation Anomaly detection at the level of run time data structures
US8984331B2 (en) 2012-09-06 2015-03-17 Triumfant, Inc. Systems and methods for automated memory and thread execution anomaly detection in a computer network
RU2514141C1 (ru) 2012-09-28 2014-04-27 Закрытое акционерное общество "Лаборатория Касперского" Способ эмуляции вызовов системных функций для обхода средств противодействия эмуляции
US8931101B2 (en) * 2012-11-14 2015-01-06 International Business Machines Corporation Application-level anomaly detection
RU2514142C1 (ru) * 2012-12-25 2014-04-27 Закрытое акционерное общество "Лаборатория Касперского" Способ повышения эффективности работы аппаратного ускорения эмуляции приложений
US9659085B2 (en) 2012-12-28 2017-05-23 Microsoft Technology Licensing, Llc Detecting anomalies in behavioral network with contextual side information
DE102013201831A1 (de) * 2013-02-05 2014-08-07 Siemens Aktiengesellschaft Verfahren und Vorrichtung zum Analysieren von Ereignissen in einem System
US9792436B1 (en) * 2013-04-29 2017-10-17 Symantec Corporation Techniques for remediating an infected file
US9292686B2 (en) 2014-01-16 2016-03-22 Fireeye, Inc. Micro-virtualization architecture for threat-aware microvisor deployment in a node of a network environment
RU2584505C2 (ru) * 2014-04-18 2016-05-20 Закрытое акционерное общество "Лаборатория Касперского" Система и способ предварительной фильтрации файлов для контроля приложений
US9356945B2 (en) * 2014-07-17 2016-05-31 Check Point Advanced Threat Prevention Ltd Automatic content inspection system for exploit detection
US9571517B2 (en) * 2014-11-11 2017-02-14 Goldman, Sachs & Co. Synthetic cyber-risk model for vulnerability determination
US9934376B1 (en) 2014-12-29 2018-04-03 Fireeye, Inc. Malware detection appliance architecture
CN104715190B (zh) * 2015-02-03 2018-02-06 中国科学院计算技术研究所 一种基于深度学习的程序执行路径的监控方法及系统
US9912681B1 (en) 2015-03-31 2018-03-06 Fireeye, Inc. Injection of content processing delay in an endpoint
US10474813B1 (en) 2015-03-31 2019-11-12 Fireeye, Inc. Code injection technique for remediation at an endpoint of a network
US9953158B1 (en) * 2015-04-21 2018-04-24 Symantec Corporation Systems and methods for enforcing secure software execution
IN2015DE01177A (fr) 2015-04-28 2015-06-26 Hcl Technologies Ltd
US10567395B2 (en) 2015-05-10 2020-02-18 Check Point Advanced Threat Prevention Ltd Detection of potentially malicious web content by emulating user behavior and user environment
US9665460B2 (en) * 2015-05-26 2017-05-30 Microsoft Technology Licensing, Llc Detection of abnormal resource usage in a data center
US10454950B1 (en) 2015-06-30 2019-10-22 Fireeye, Inc. Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks
CN105095047B (zh) * 2015-07-17 2018-05-04 中国科学院计算技术研究所 一种提取底层系统行为特征的操作系统监控方法及装置
US10397255B1 (en) * 2015-09-23 2019-08-27 StackRox, Inc. System and method for providing security in a distributed computation system utilizing containers
US10417579B2 (en) * 2015-09-25 2019-09-17 Mcafee, Inc. Multi-label classification for overlapping classes
US9923911B2 (en) * 2015-10-08 2018-03-20 Cisco Technology, Inc. Anomaly detection supporting new application deployments
KR101703446B1 (ko) * 2015-10-15 2017-02-06 숭실대학교산학협력단 DoS 공격의 탐지가 가능한 네트워크 및 이의 제어 방법과, 상기 네트워크에 포함되는 게이트웨이 및 관리 서버
US10846117B1 (en) 2015-12-10 2020-11-24 Fireeye, Inc. Technique for establishing secure communication between host and guest processes of a virtualization architecture
US10447728B1 (en) 2015-12-10 2019-10-15 Fireeye, Inc. Technique for protecting guest processes using a layered virtualization architecture
US10108446B1 (en) 2015-12-11 2018-10-23 Fireeye, Inc. Late load technique for deploying a virtualization layer underneath a running operating system
US9998483B2 (en) 2015-12-22 2018-06-12 Mcafee, Llc Service assurance and security of computing systems using fingerprinting
KR101871340B1 (ko) * 2015-12-31 2018-06-27 충남대학교산학협력단 평가지표 자율제안에 의한 연구개발과제 선정 시스템
US10432650B2 (en) 2016-03-31 2019-10-01 Stuart Staniford System and method to protect a webserver against application exploits and attacks
US20180046936A1 (en) * 2016-08-10 2018-02-15 Futurewei Technologies, Inc. Density-based apparatus, computer program, and method for reclassifying test data points as not being an anomoly
US10191861B1 (en) 2016-09-06 2019-01-29 Fireeye, Inc. Technique for implementing memory views using a layered virtualization architecture
US10216877B2 (en) * 2016-09-28 2019-02-26 Altera Corporation Smart diagnosis of integrated circuits including IP cores with encrypted simulation models
US10127125B2 (en) * 2016-10-21 2018-11-13 Accenture Global Solutions Limited Application monitoring and failure prediction
US10338991B2 (en) * 2017-02-21 2019-07-02 Microsoft Technology Licensing, Llc Cloud-based recovery system
KR101920683B1 (ko) 2017-03-06 2018-11-21 연세대학교 산학협력단 단일 클래스 기반의 데이터 수집 장치 및 방법
US10437663B2 (en) 2017-04-14 2019-10-08 Microsoft Technology Licensing, Llc Administrative user communication and error recovery
US11503051B2 (en) 2018-01-11 2022-11-15 Perspecta Labs Inc. Migration of traffic flows
CN108763075A (zh) * 2018-05-21 2018-11-06 北京五八信息技术有限公司 一种测试方法、装置、设备及计算机可读存储介质
CN108959070B (zh) * 2018-06-13 2022-05-10 珠海金山网络游戏科技有限公司 一种基于代码对象的Python钩子函数方法和装置
US10922203B1 (en) * 2018-09-21 2021-02-16 Nvidia Corporation Fault injection architecture for resilient GPU computing
US10657025B2 (en) * 2018-10-18 2020-05-19 Denso International America, Inc. Systems and methods for dynamically identifying data arguments and instrumenting source code
US11204856B2 (en) * 2019-01-18 2021-12-21 International Business Machines Corporation Adaptive performance calibration for code
CN109815152A (zh) * 2019-01-31 2019-05-28 科大讯飞股份有限公司 程序崩溃类型预测方法及系统
CN110048901B (zh) * 2019-06-04 2022-03-22 广东电网有限责任公司 一种电力通信网的故障定位方法、装置及设备
CN110245082A (zh) * 2019-06-06 2019-09-17 惠州市德赛西威汽车电子股份有限公司 一种偶现问题自动测试系统及其方法
FR3097665B1 (fr) * 2019-06-20 2021-10-01 Thales Sa Procédé de validation automatique de cots et dispositif pour la mise en oeuvre du procédé
RU2739831C1 (ru) * 2019-11-27 2020-12-28 Акционерное общество "Лаборатория Касперского" Способ устранения неполадки, возникшей при работе приложения
RU2739867C1 (ru) * 2019-11-27 2020-12-29 Акционерное общество "Лаборатория Касперского" Способ определения модуля приложения, связанного с причиной неполадки, возникшей при работе приложения
US11394750B1 (en) 2020-02-28 2022-07-19 Red Hat, Inc. System and method for generating network security policies in a distributed computation system utilizing containers
CN111510438B (zh) * 2020-03-29 2022-04-05 国网陕西省电力公司延安供电公司 一种面向电力物联网终端数据分类的管控方法
US11403427B2 (en) * 2020-09-11 2022-08-02 Arms Cyber Defense, Inc. Methods and systems for reinforcement learning of post-attack security hardening passes
US11294783B1 (en) * 2020-09-24 2022-04-05 Raytheon Company Non-invasive program execution protection
CN112445642B (zh) * 2020-11-09 2023-05-16 浙江吉利控股集团有限公司 异常处理方法、远程泊车辅助系统及计算机存储介质
US11811804B1 (en) 2020-12-15 2023-11-07 Red Hat, Inc. System and method for detecting process anomalies in a distributed computation system utilizing containers
US12190131B2 (en) * 2021-03-25 2025-01-07 Tata Consultancy Services Limited Method and system for function call and variable access based relaxed backward slicing
CN114039784B (zh) * 2021-11-10 2023-11-14 中国人民解放军战略支援部队信息工程大学 一种网络协议口令猜测攻击识别方法
EP4242852B1 (fr) * 2022-03-07 2024-06-26 Tata Consultancy Services Limited Procédé et système d'identification de changements pertinents pour une vérification incrémentielle de logiciel évolutif
CN114780346B (zh) * 2022-04-26 2025-08-22 北京金堤科技有限公司 获取程序卡顿信息的方法、装置、存储介质和电子设备
US11989296B2 (en) 2022-10-13 2024-05-21 Cybersentry.Ai, Inc. Program execution anomaly detection for cybersecurity
CN117155881B (zh) * 2023-10-31 2024-01-30 深圳市吉彼特通信技术有限公司 一种具有循环散热结构的工业交换机性能评估方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968113A (en) * 1994-08-10 1999-10-19 Intrinsa Corporation Computer process resource modelling method and apparatus
US20050108562A1 (en) * 2003-06-18 2005-05-19 Khazan Roger I. Technique for detecting executable malicious code using a combination of static and dynamic analyses
US7155708B2 (en) * 2002-10-31 2006-12-26 Src Computers, Inc. Debugging and performance profiling using control-dataflow graph representations with reconfigurable hardware emulation
US7490268B2 (en) 2004-06-01 2009-02-10 The Trustees Of Columbia University In The City Of New York Methods and systems for repairing applications
US7496898B1 (en) * 2004-04-15 2009-02-24 Sun Microsystems, Inc. Error analysis and diagnosis for generic function calls
US7639714B2 (en) 2003-11-12 2009-12-29 The Trustees Of Columbia University In The City Of New York Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data

Family Cites Families (62)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2277151B (en) 1993-04-05 1997-06-25 Univ Brunel Neural network based machine health monitoring system
US5398196A (en) 1993-07-29 1995-03-14 Chambers; David A. Method and apparatus for detection of computer viruses
US5696822A (en) 1995-09-28 1997-12-09 Symantec Corporation Polymorphic virus detection module
GB2321364A (en) 1997-01-21 1998-07-22 Northern Telecom Ltd Retraining neural network
US5964889A (en) 1997-04-16 1999-10-12 Symantec Corporation Method to analyze a program for presence of computer viruses by examining the opcode for faults before emulating instruction in emulator
US5978917A (en) 1997-08-14 1999-11-02 Symantec Corporation Detection and elimination of macro viruses
US6357008B1 (en) 1997-09-23 2002-03-12 Symantec Corporation Dynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases
US6681331B1 (en) * 1999-05-11 2004-01-20 Cylant, Inc. Dynamic software system intrusion detection
US7185367B2 (en) * 1999-05-11 2007-02-27 Cylant, Inc. Method and system for establishing normal software system behavior and departures from normal behavior
US6952776B1 (en) 1999-09-22 2005-10-04 International Business Machines Corporation Method and apparatus for increasing virus detection speed using a database
EP1117035A1 (fr) 2000-01-14 2001-07-18 Sun Microsystems, Inc. Services de composants pour un environnement d'exécution
KR100367129B1 (ko) 2000-03-21 2003-01-09 주식회사 하우리 다형성 바이러스 진단시스템 및 그 방법
US6721721B1 (en) 2000-06-15 2004-04-13 International Business Machines Corporation Virus checking and reporting for computer database search results
GB0016835D0 (en) 2000-07-07 2000-08-30 Messagelabs Limited Method of, and system for, processing email
US7069583B2 (en) 2000-07-14 2006-06-27 Computer Associates Think, Inc. Detection of polymorphic virus code using dataflow analysis
US8341743B2 (en) 2000-07-14 2012-12-25 Ca, Inc. Detection of viral code using emulation of operating system functions
US6408245B1 (en) * 2000-08-03 2002-06-18 American Gnc Corporation Filtering mechanization method of integrating global positioning system receiver with inertial measurement unit
US7072876B1 (en) * 2000-09-19 2006-07-04 Cigital System and method for mining execution traces with finite automata
US7146305B2 (en) * 2000-10-24 2006-12-05 Vcis, Inc. Analytical virtual machine
US20020095607A1 (en) 2001-01-18 2002-07-18 Catherine Lin-Hendel Security protection for computers and computer-networks
US7089592B2 (en) * 2001-03-15 2006-08-08 Brighterion, Inc. Systems and methods for dynamic detection and prevention of electronic fraud
US20020188167A1 (en) * 2001-06-06 2002-12-12 Anthony Viole Multilumen catheter for minimizing limb ischemia
JP4566460B2 (ja) 2001-06-07 2010-10-20 パイオニア株式会社 電子メールのウィルスチェックシステム
US20020194490A1 (en) 2001-06-18 2002-12-19 Avner Halperin System and method of virus containment in computer networks
US6718469B2 (en) 2001-08-01 2004-04-06 Networks Associates Technology, Inc. System and method for executing computer virus definitions containing general purpose programming language extensions
US7356736B2 (en) 2001-09-25 2008-04-08 Norman Asa Simulated computer system for monitoring of software performance
US7409717B1 (en) 2002-05-23 2008-08-05 Symantec Corporation Metamorphic computer virus detection
US7331062B2 (en) 2002-08-30 2008-02-12 Symantec Corporation Method, computer software, and system for providing end to end security protection of an online transaction
US7412723B2 (en) 2002-12-31 2008-08-12 International Business Machines Corporation Method and system for morphing honeypot with computer security incident correlation
US7293201B2 (en) 2003-01-17 2007-11-06 Microsoft Corporation System and method for active diagnosis and self healing of software systems
US20040153644A1 (en) 2003-02-05 2004-08-05 Mccorkendale Bruce Preventing execution of potentially malicious software
US7269824B2 (en) * 2003-02-13 2007-09-11 Path Reliability, Inc. Software behavior pattern recognition and analysis
US7716736B2 (en) 2003-04-17 2010-05-11 Cybersoft, Inc. Apparatus, methods and articles of manufacture for computer virus testing
US7593936B2 (en) * 2003-08-11 2009-09-22 Triumfant, Inc. Systems and methods for automated computer support
US7644441B2 (en) 2003-09-26 2010-01-05 Cigital, Inc. Methods for identifying malicious software
US7318226B2 (en) 2003-10-16 2008-01-08 International Business Machines Corporation Distributed autonomic solutions repository
US7506241B2 (en) 2003-10-16 2009-03-17 International Business Machines Corporation Method and apparatus for a self healing agent
US7373524B2 (en) * 2004-02-24 2008-05-13 Covelight Systems, Inc. Methods, systems and computer program products for monitoring user behavior for a server application
US7289906B2 (en) * 2004-04-05 2007-10-30 Oregon Health & Science University Navigation system applications of sigma-point Kalman filters for nonlinear estimation and sensor fusion
WO2005116797A1 (fr) 2004-05-19 2005-12-08 Computer Associates Think, Inc. Procede et systeme permettant d'isoler un courrier electronique suspect
US7207065B2 (en) * 2004-06-04 2007-04-17 Fortify Software, Inc. Apparatus and method for developing secure software
US7523500B1 (en) 2004-06-08 2009-04-21 Symantec Corporation Filtered antivirus scanning
US7748038B2 (en) 2004-06-16 2010-06-29 Ironport Systems, Inc. Method and apparatus for managing computer virus outbreaks
US20060010495A1 (en) 2004-07-06 2006-01-12 Oded Cohen Method for protecting a computer from suspicious objects
US7603715B2 (en) 2004-07-21 2009-10-13 Microsoft Corporation Containment of worms
US7818781B2 (en) * 2004-10-01 2010-10-19 Microsoft Corporation Behavior blocking access control
US20070028220A1 (en) * 2004-10-15 2007-02-01 Xerox Corporation Fault detection and root cause identification in complex systems
ITRM20040517A1 (it) 2004-10-20 2005-01-20 Diego Angelo Tomaselli Metodo e sistema antivirus.
US20060168329A1 (en) 2004-11-30 2006-07-27 Sensory Networks, Inc. Apparatus and method for acceleration of electronic message processing through pre-filtering
US7647589B1 (en) 2005-02-07 2010-01-12 Parallels Software International, Inc. Methods and systems for safe execution of guest code in virtual machine context
US7770153B2 (en) * 2005-05-20 2010-08-03 Microsoft Corporation Heap-based bug identification using anomaly detection
US7490355B2 (en) * 2005-06-16 2009-02-10 Chung Shan Institute Of Science And Technology Method of detecting network worms
US7526758B2 (en) * 2005-06-30 2009-04-28 Microsoft Corporation Execution failure investigation using static analysis
WO2007050667A2 (fr) * 2005-10-25 2007-05-03 The Trustees Of Columbia University In The City Of New York Procedes, supports et systemes de detection d'executions de programme anormales
US7975059B2 (en) 2005-11-15 2011-07-05 Microsoft Corporation Generic application level protocol analyzer
US7840946B2 (en) * 2006-06-02 2010-11-23 International Business Machines Corporation System and method for matching a plurality of ordered sequences with applications to call stack analysis to identify known software problems
WO2008055156A2 (fr) * 2006-10-30 2008-05-08 The Trustees Of Columbia University In The City Of New York Procedes, supports et systemes permettant de detecter une sequence anormale d'appels de fonction
US8255092B2 (en) * 2007-05-14 2012-08-28 Irobot Corporation Autonomous behaviors for a remote vehicle
US8141163B2 (en) 2007-07-31 2012-03-20 Vmware, Inc. Malicious code detection
US8010763B2 (en) 2007-08-02 2011-08-30 International Business Machines Corporation Hypervisor-enforced isolation of entities within a single logical partition's virtual address space
US8214900B1 (en) 2008-12-18 2012-07-03 Symantec Corporation Method and apparatus for monitoring a computer to detect operating system process manipulation
US8997218B2 (en) 2010-12-22 2015-03-31 F-Secure Corporation Detecting a return-oriented programming exploit

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968113A (en) * 1994-08-10 1999-10-19 Intrinsa Corporation Computer process resource modelling method and apparatus
US6079031A (en) * 1994-08-10 2000-06-20 Microsoft Corporation Computer process resource modelling method and apparatus
US6154876A (en) * 1994-08-10 2000-11-28 Intrinsa Corporation Analysis of the effect of program execution of calling components with data variable checkpointing and resource allocation analysis
US7155708B2 (en) * 2002-10-31 2006-12-26 Src Computers, Inc. Debugging and performance profiling using control-dataflow graph representations with reconfigurable hardware emulation
US20050108562A1 (en) * 2003-06-18 2005-05-19 Khazan Roger I. Technique for detecting executable malicious code using a combination of static and dynamic analyses
US7639714B2 (en) 2003-11-12 2009-12-29 The Trustees Of Columbia University In The City Of New York Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
US7496898B1 (en) * 2004-04-15 2009-02-24 Sun Microsystems, Inc. Error analysis and diagnosis for generic function calls
US7490268B2 (en) 2004-06-01 2009-02-10 The Trustees Of Columbia University In The City Of New York Methods and systems for repairing applications

Non-Patent Citations (117)

* Cited by examiner, † Cited by third party
Title
A. Avizienis, The n-version approach to fault-tolerant software, IEEE Transactionson Software Engineering, 11 (12):1491-1501, 1985.
A. Baratloo, N. Singh, and T. Tsai, Transparent Run-Time Defense Against Stack Smashing Attacks, In Proceedings of the Annual Technical Conference, Jun. 2000.
A. Honig, A. Howard, E. Eskin, and S. Stolfo, Adaptive model generation: An architecture for the deployment of data mining-based intrusion detection systems, in Data Mining for Security Applications, Kluwer, 2002.
A. J. Malton, The Denotational Semantics of a Functional Tree-Manipulation Language, Computer Languages, 19 (3):157-168, 1993.
A. Rudys and D. S. Wallach, Termination in Language-based Systems, ACM Transactions on Information and System Security, 5(2), May 2002.
A. Rudys and D. S. Wallach, Transactional Rollback for Language-Based Systems, In ISOC Symposium on Network and Distributed Systems Security (SNDSS), Feb. 2001.
A. Smirnov and T. Chiueh, DIRA: Automatic Detection, Identication, and Repair of Control-Hijacking Attacks, In The 12th Annual Network and Distributed System Security Symposium, Feb. 2005.
A. Whitaker, M. Shaw, and S. D. Gribble, Scale and Performance in the Denali Isolation Kernel, In Proceedings of the Fifth Symposium on Operating Systems Design and Implementation (OSDI), Dec. 2002.
Aleph One, Smashing the stack for fun and profit, Phrack, 7(49), 1996.
B. Chess, Improving Computer Security Using Extended Static Checking, In Proceedings of the IEEE Symposium on Security and Privacy, May 2002.
B. Demsky and M. C. Rinard, Automatic Detection and Repair of Errors in Data Structures, In Proceedings of the 18th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, Oct. 2003.
B. Scholkopf, J. Platt, J. Shawe-Taylor, A. Smola, and R. Williamson, Estimating the support of a high dimensional distribution, Neural Computation, 13(7):1443-1472, 2001.
Bulba and Kil3r, Bypassing StackGuard and StackShield, Phrack, 5(56), May 2000.
C. C. Zou, L. Gao, W. Gong, and D. Towsley, Monitoring and Early Warning for Internet Worms, In Proceedings of the 10th ACM International Conference on Computer and Communications Security (CCS), pp. 190-199, Oct. 2003.
C. C. Zou, W. Gong, and D. Towsley, Code Red Worm Propagation Modeling and Analysis, In Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS), pp. 138-147, Nov. 2002.
C. Cowan et al., StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overow Attacks, In Proceedings of the 7th Security Symposium, Jan. 1998.
C. Cowan, C. Pu, D. Maier, H. Hinton, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Q. Zhang, Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks, In Proceedings of the 7th USENIX Security Symposium, Jan. 1998.
C. Cowan, M. Barringer, S. Beattie, and G. Kroah-Hartman, Formatguard: Automatic protection from printf format string vulnerabilities, In Proceedings of the 10th USENIX Security Symposium, Aug. 2001.
C. Cowan, S. Beattie, C. Pu, P. Wagle, and V. Gligor, SubDomain: Parsimonious Security for Server Appliances, In Proceedings of the 14th USENIX System Administration Conference (LISA 2000), Mar. 2000.
C. Nachenberg, Computer Virus-Coevolution, Communications of the ACM, 50(1):46-51, 1997.
C. Wang, J. C. Knight, and M. C. Elder, on Computer Viral Infection and the Effect of Immunization, In Proceedings of the 16th Annual Computer Security Applications Conference (ACSAC), pp. 246-256, 2000.
C. Warrender, S. Forrest, B. Pearlmutter, Detecting intrusions using system calls: Alternative data models, IEEE Symposium on Security and Privacy, pp. 133-145, 1999.
CERT Advisory CA-2003-21: W32/Blaster Worm, http://www.cert.org/advisories/CA-2003-20.html, Aug. 2003.
Chan et al., A machine learning approach to anomaly detection, Technical Report, Dept. of computer science, Florida institute of technology, Mar. 2003, pp. 1-13. *
D. Bruening, T. Garnett, and S. Amarasinghe, An Infrastructure for Adaptive Dynamic Optimization, In Proceedings of the International Symposium on Code Generation and Optimization, pp. 265-275, 2003.
D. Denning, An intrusion detection model, IEEE Transactions on Software Engineering, SE-13:222-232, Feb. 1987.
D. Engler and K. Ashcraft, RacerX: Effective, Static Detection of Race Conditions and Deadlocks, Proceedings of ACM SOSP, Oct. 2003.
D. Larochelle and D. Evans, Statically Detecting Likely Buffer Overflow Vulnerabilities, In Proceedings of the 10th Security Symposium, pp. 177-190, Aug. 2001.
D. Moore, C. Shanning, and K. Claffy, Code-Red: a case study on the spread and victims of an Internet worm. In Proceedings of the 2nd Internet Measurement Workshop (IMW), pp. 273-284, Nov. 2002.
D. Moore, C. Shannon, G. Voelker, and S. Savage, Internet Quarantine: Requirements for Containing Self-Propagating Code, In Proceedings of the IEEE Infocom Conference, Apr. 2003.
D. Mosberger and T. Jin, httperf: A tool for measuring web server performance, In First Workshop on Internet Server Performance, pp. 59-67, ACM, Jun. 1998.
D. Nojiri, J. Rowe, and K. Levitt, Cooperative Response Strategies for Large Scale Attack Mitigation, In Proceedings of the 3rd DARPA Information Survivability Conference and Exposition (DISCEX), pp. 293-302, Apr. 2003.
D. S. Peterson, M. Bishop, and R. Pandey, A Flexible Containment Mechanism for Executing Untrusted Code, In Proceedings of the 11th USENIX Security Symposium, pp. 207-225, Aug. 2002.
E. Eskin, Anomaly detection over noisy data using learned probability distributions, Proceedings of the Seventeenth International Conference on Machine Learning (ICML-2000), 2000.
E. G. Barrantes, D. H. Ackley, S. Forrest, T. S. Palmer, D. Stefanovic, and D. D. Zovi, Randomized Instruction Set Emulation to Distrupt Binary Code Injection Attacks, in 10th ACM Conference on Computer and Communications Security (CCS), Oct. 2003.
E. H. Spafford, The Internet Worm Program: An Analysis, Technical Report CSD-TR-823, Purdue University, 1988.
E. Larson and T. Austin, High Coverage Detection of Input-Related Security Faults, In Proceedings of the 12th Security Symposium, pp. 121-136, Aug. 2003.
F. Apap, A. Honig, S. Hershkop, E. Eskin, and S. Stolfo, Detecting malicious software by monitoring anomalous windows registry accesses, Proceedings of the Fifth International Symposium on Recent Advances in Intrusion Detection (RAID 2002), 2002.
F. Cohen, Computer Viruses: Theory and Practice, Computers & Security, 6:22-35, Feb. 1987.
G. Candea and A. Fox, Crash-Only Software, in Proceedings of the 9th Workshop on Hot Topics in Operating Systems, May 2003.
G. E. Suh, J. W. Lee, D. Zhang, and S. Devadas, Secure program execution via dynamic information flow tracking, SIGOPS Oper. Syst. Rev., 38(5):85-96, 2004.
G. S. Kc, A. D. Keromytis, and V. Prevelakis, Countering Code-Injection Attacks With Instruction-Set Randomization, in 10th ACM Conference on Computer and Communications Security (CCS), Oct. 2003.
G. Venkitachalam and B.-H. Lim, Virtualizing i/o devices on vmware workstation's hosted virtual machine monitor.
G. W. Dunlap, S. King, S. Cinar, M. A. Basrai, and P. M. Chen, ReVirt: Enabling Intrusion Analysis Through Virtual-Machine Logging and Replay, In Proceedings of the Symposium on Operating Systems Design and Implementation (OSDI), Feb. 2002.
H. Chen and D. Wagner, MOPS: an Infrastructure for Examining Security Properties of Software, In Proceedings of the ACM Computer and Communications Security (CCS) Conference, pp. 235-244, Nov. 2002.
H. Javitz and A. Valdes, The nides statistical component: Description and justification, Technical Report, SRI International, Computer Science Laboratory, 1993.
H. Shacham, M. Page, B. Pfaff, E. Goh, N. Modadugu, and D. Boneh, on the Effectiveness of Address-Space Randomization, In Proceedings of the 11th ACM Conference on Computer and Communications Security (CCS), pp. 298-307, Oct. 2004.
H. Toyoizumi and A. Kara, Predators: Good Will Mobile Codes Combat against Computer Viruses, In Proceedings of the New Security Paradigms Workshop (NSPW), pp. 13-21, Sep. 2002.
Hangal et al., Tracking down software bugs using automatic anomaly detection, Proceedings of the 24the international conference on software engineering, May 2002, pp. 291-301. *
I. Goldberg, D. Wagner, R. Thomas, and E. Brewer, A Secure Environment for Untrusted Helper Applications, In Proceedings of the 1996 USENIX Annual Technical Conference, 1996.
Interational Search Report and Written Opinion, International Application No. PCT/US06/41591, dated Jun. 25, 2008.
J. F. Shoch and J. A. Hupp, The "worm" programs-early experiments with a distributed computation, Communications of the ACM, 22(3):172-180, Mar. 1982.
J. F. Shoch and J. A. Hupp, The "worm" programs—early experiments with a distributed computation, Communications of the ACM, 22(3):172-180, Mar. 1982.
J. Just, L. Clough, M. Danforth, K. Levitt, R. Maglich, J. C. Reynolds, and J. Rowe, Learning Unknown Attacks-A Start, In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2002.
J. Just, L. Clough, M. Danforth, K. Levitt, R. Maglich, J. C. Reynolds, and J. Rowe, Learning Unknown Attacks—A Start, In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2002.
J. Kephart, A Biologically Inspired Immune System for Computers, In Artificial Life IV: Proceedings of the Fourth International Workshop on the Synthesis and Simulation of Living Systems, pp. 130-139. MIT Press, 1994.
J. Newsome and D. Dong, Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software, In The 12th Annual Network and Distributed System Security Symposium, Feb. 2005.
J. Oplinger and M. S. Lam, Enhancing Software Reliability with Speculative Threads, In Proceedings of the 10th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS X), Oct. 2002.
J. Reynolds, J. Just, E. Lawson, L. Clough, and R. Maglich, The Design and Implementation of an Intrusion Tolerant System, In Proceedings of the International Conference on Dependable Systems and Networks (DSN), Jun. 2002.
J. Reynolds, J. Just, L. Clough, and R. Maglich, On-Line Intrusion Detection and Attack Prevention Using Diversity, Generate-and-Test, and Generalization, In Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS), Jan. 2003.
J. Twycross and M. M. Williamson, Implementing and testing a virus throttle, In Proceedings of the 12th USENIX Security Symposium, pp. 285-294, Aug. 2003.
J. Wilander and M. Kamkar, A Comparison of Publicly Available Tools for Dynamic Intrusion Prevention, In Proceedings of the Symposium on Network and Distributed Systems Security (SNDSS), pp. 123-130, Feb. 2003.
J. Yin, J.-P. Martin, A. Venkataramani, L. Alvisi, and M. Dahlin, Separating Agreement from Execution for Byzantine Fault Tolerant Services, in Proceedings of ACM SOSP, Oct. 2003.
K. Ashcraft and D. Engler, Detecting Lots of Security Holes Using System-Specific Static Analysis, In Proceedings of the IEEE Symposium on Security and Privacy, May 2002.
K. Lhee and S. J. Chapin, Type-Assisted Dynamic Buffer Overflow Detection. In Proceedings of the 11th Security Symposium, pp. 81-90, Aug. 2002.
M. Bhattacharyya, M. G. Schultz, E. Eskin, S. Hershkop, and S. J. Stolfo, MET: An Experimental System for Malicious Email Tracking, In Proceedings of the New Security Paradigms Workshop (NSPW), pp. 1-12, Sep. 2002.
M. Chew and D. Song, Mitigating Buffer Overflows by Operating System Randomization, Technical Report CMUCS-02-197, Carnegie Mellon University, Dec. 2002.
M. Christodorescu and S. Jha, Static Analysis of Executables to Detect Malicious Patterns, In Proceedings of the 12th USENIX Security Symposium, pp. 169-186, Aug. 2003.
M. Frantzen and M. Shuey, StackGhost: Hardware facilitated stack protection, In Proceedings of the 10th USENIX Security Symposium, pp. 55-66, Aug. 2001.
M. Kodialam and T. V. Lakshman, Detecting Network Intrusions via Sampling: A Game Theoretic Approach, In Proceedings of the 22nd Annual Joint Conference of IEEE Computer and Communication Societies (INFOCOM), Apr. 2003.
M. Mahoney and P. Chan, Detecting novel attacks by identifying anomalous network packet headers, Technical Report CS-2001-2, 2001.
M. Prasad and T. Chiueh, A Binary Rewriting Defense Against Stack-based Buffer Overflow Attacks, In Proceedings of the USENIX Annual Technical Conference, pp. 211-224, Jun. 2003.
M. Rinard, C. Cadar, D. Dumitran, D. Roy, and T. Leu, A Dynamic Technique for Eliminating Buffer Overow Vulnerabilities (and Other Memory Errors), In Proceedings 20th Annual Computer Security Applications Conference (ACSAC), Dec. 2004.
M. Rinard, C. Cadar, D. Dumitran, D. Roy, T. Leu, and J. W Beebee, Enhancing Server Availability and Security Through Failure-Oblivious Computing, In Proceedings 6th Symposium on Operating Systems Design and Implementation (OSDI), Dec. 2004.
M. Rosenblum, E. Bugnion, S. Devine, and S. A. Herrod, Using the SimOS Machine Simulator to Study Complex Computer Systems, Modeling and Computer Simulation, 7(1):78-103, 1997.
M. Stamp, Risk of Monoculture, Communications of the ACM, 47(3):120, Mar. 2004.
M. Williamson, Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code, Technical Report HPL-2002-172, HP Laboratories Bristol, 2002.
M.-J. Lin, A. Ricciardi, and K. Marzullo, A New Model for Availability in the Face of Self-Propagating Attacks, In Proceedings of the New Security Paradigms Workshop, Nov. 1998.
N. Friedman and Y. Singer, Efficient bayesian parameter estimation in large discrete domains, Advances in Neural Information Processing Systems, 11, 1999.
N. Nethercote and J. Seward, Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation, PLDI '07, Jun. 2007.
N. Nethercote and J. Seward, Valgrind: A Program Supervision Framework, In Electronic Notes in Theoretical Computer Science, vol. 89, 2003.
N. Provos, Improving Host Security with System Call Policies, In Proceedings of the 12th USENIX Security Symposium, pp. 257-272, Aug. 2003.
N. Provos, M. Friedl, and P. Honeyman, Preventing Privilege Escalation, In Proceedings of the 12th USENIX Security Symposium, pp. 231-242, Aug. 2003.
N. Wang, M. Fertig, and S. Patel, Y-Branches: When You Come to a Fork in the Road, Take It, In Proceedings of the 12th International Conference on Parallel Architectures and Compilation Techniques, Sep. 2003.
P. Chan, M. Mahoney, and M. Arshad, A Machine Learning Approach to Anomaly Detection, Technical Report CS-2003-06, Department of Computer Sciences, Florida Institute of Technology, Mar. 29, 2003.
R. Janakiraman, M. Waldvogel, and Q. Zhang, Indra: A peer-topeer approach to network intrusion detection and prevention, In Proceedings of the IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), Workshop on Enterprise Security, Jun. 2003.
R. Jones and P. Kelly, Backwards-compatible bounds checking for arrays and pointers in C programs, In Third International Workshop on Automated Debugging, 1997.
R. Sekar, V. Venkatakrishnan, S. Basu, S. Bhatkar, and D. C. DuVaney, Model-Carrying Code: A Practice Approach for Safe Execution of Untrusted Applications, in Proceedings of ACM SOSP, Oct. 2003.
S. A. Crosby and D. S. Wallach, Denial of Service via Algorithmic Complexity Attacks, In Proceedings of the 12th USENIX Security Symposium, pp. 29-44, Aug. 2003.
S. Bhatkar, D. C. DuVarney, and R. Sekar, Address Obfuscation: an Efficient Approach to Combat a Broad Range of Memory Error Exploits, In Proceedings of the 12th Security Symposium, pp. 105-120, Aug. 2003.
S. Brilliant, J. C. Knight, and N. G. Leveson, Analysis of Faults in an N-Version Software Experiment, IEEE Transactions on Software Engineering, 16(2), Feb. 1990.
S. Forrest, A. Somayaji, and D. Ackley, Building Diverse Computer Systems, In Proceedings of the 6th HotOS Workshop, 1997.
S. Forrest, S. Hofmeyr, A. Somayaji, and T. Longstaff, A sense of self for unix processes, Proceedings of the IEEE Symposium on Research in Security and Privacy, pp. 120-128, 1996.
S. Hangal and M. Lam, Tracking Down Software Bugs Using Automatic Anomaly Detection, ICSE '02. May 19-25, 2002, pp. 291-301.
S. Hofmeyr, S. Forrest, and A. Somayaji, Intrusion detection using sequences of system calls, Journal of Computer Security, 6:151-180, 1998.
S. loannidis, A. Keromytis, S. Bellovin, and J. Smith, Implementing a Distributed Firewall, In Proceedings of the ACM Computer and Communications Security (CCS) Conference, pp. 190-199, Nov. 2000.
S. M. Bellovin, Distributed Firewalls, ;login: magazine, special issue on security, Nov. 1999.
S. Sidiroglou and A. D. Keromytis, A Network Worm Vaccine Architecture. In Proceedings of the IEEE Workshop on Enterprise Technologies: Infrastructure for Collaborative Enterprises (WET-ICE), Workshop on Enterprise Security, pp. 220-225, Jun. 2003.
S. Sidiroglou, M. Locasto, S. Boyd, and A. Keromytis, Building A Reactive Immune System for Software Services, In Proceedings of the 11th USENIX Annual Technical Conference, Apr. 2005.
S. Staniford, V. Paxson, and N. Weaver, How to Own the Internet in Your Spare Time, In Proceedings of the 11th USENIX Security Symposium, pp. 149-167, Aug. 2002.
S. T. King and P. M. Chen, Backtracking Intrusions, In 19th ACM Symposium on Operating Systems Principles (SOSP), Oct. 2003.
S. T. King, G. Dunlap, and P. Chen, Operating System Support for Virtual Machines, In Proceedings of the Annual Technical Conference, Jun. 2003.
S. White, Open problems in computer virus reseach, in Virus Bulletin Conference, 1998.
Song, R. Malan, and R. Stone.,A Snapshot of Global Internet Worm Activity, Technical report, Arbor Networks, Nov. 2001.
T. C. Miller and T. de Raadt, strlcpy and strlcat: Consistent, Safe, String Copy and Concatenation, In Proceedings of the USENIX Annual Technical Conference, Freenix Track, Jun. 1999.
T. Garfinkel and M. Rosenblum, A Virtual Machine Introspection Based Architecture for Intrusion Detection, in 10th ISOC Symposium on Network and Distributed Systems Security (SNDSS), Feb. 2003.
T. Garfinkel, Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools, In Proceedings of the Symposium on Network and Distributed Systems Security (SNDSS), pp. 163-176, Feb. 2003.
T. Jim, G. Morrisett, D. Grossman, M. Hicks, J. Cheney, and Y. Wang, Cyclone: A safe dialect of C, In Proceedings of the Annual Technical Conference, pp. 275-288, Jun. 2002.
T. Toth and C. Kruegel, Accurate Buffer Overflow Detection via Abstract Payload Execution, In Proceedings of the 5th Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2002.
T. Toth and C. Kruegel, Connection-history Based Anomaly Detection, In Proceedings of the IEEE Workshop on Information Assurance and Security, Jun. 2002.
Using Network-Based Application Recognition and ACLs for Blocking the "Code Red" Worm, Technical report, Cisco Systems, Inc.
V. Kiriansky, D. Bruening, and S. Amarasinghe, Secure Execution Via Program Shepherding, In Proceedings of the 11th Security Symposium, Aug. 2002.
V. Prevelakis and D. Spinellis, Sandboxing Applications, In Proceedings of the USENIX Technical Annual Conference, Freenix Track, pp. 119-126, Jun. 2001.
V. Prevelakis, A Secure Station for Network Monitoring and Control, In Proceedings of the 8th USENIX Security Symposium, Aug. 1999.
W. Lee, S. Stolfo, and K. Mok, A data mining framework for building intrusion detection models, IEEE Symposium on Security and Privacy, pp. 120-132, 1999.
W. Lee, S. Stolfo, and K. Mok, Data mining in work flow environments: Experiences in intrusion detection, Proceedings of the 1999 Conference on Knowledge Discovery and Data Mining (KDD-99), 1999.
W. Lee, S. Stolfo, and P. Chan, Learning patterns from unix processes execution traces for intrusion detection, AAAI Workshop on AI Approaches to Fraud Detection and Risk Management, pp. 50-56, 1997.

Cited By (65)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8407785B2 (en) 2005-08-18 2013-03-26 The Trustees Of Columbia University In The City Of New York Systems, methods, and media protecting a digital data processing device from attack
US9544322B2 (en) 2005-08-18 2017-01-10 The Trustees Of Columbia University In The City Of New York Systems, methods, and media protecting a digital data processing device from attack
US9143518B2 (en) 2005-08-18 2015-09-22 The Trustees Of Columbia University In The City Of New York Systems, methods, and media protecting a digital data processing device from attack
US8601322B2 (en) * 2005-10-25 2013-12-03 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting anomalous program executions
US20120151270A1 (en) * 2005-10-25 2012-06-14 Stolfo Salvatore J Methods, media, and systems for detecting anomalous program executions
US20140215276A1 (en) * 2005-10-25 2014-07-31 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting anomalous program executions
US9306969B2 (en) 2005-10-27 2016-04-05 Georgia Tech Research Corporation Method and systems for detecting compromised networks and/or computers
US10044748B2 (en) 2005-10-27 2018-08-07 Georgia Tech Research Corporation Methods and systems for detecting compromised computers
US8566928B2 (en) 2005-10-27 2013-10-22 Georgia Tech Research Corporation Method and system for detecting and responding to attacking networks
US11106799B2 (en) 2006-10-30 2021-08-31 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US10423788B2 (en) 2006-10-30 2019-09-24 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US8489931B2 (en) 2006-10-30 2013-07-16 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US9450979B2 (en) 2006-10-30 2016-09-20 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US8694833B2 (en) 2006-10-30 2014-04-08 The Trustees Of Columbia University In The City Of New York Methods, media, and systems for detecting an anomalous sequence of function calls
US9558019B2 (en) 2007-03-22 2017-01-31 Invention Science Fund I, Llc Coordinating instances of a thread or other service in emulation
US20080235001A1 (en) * 2007-03-22 2008-09-25 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Implementing emulation decisions in response to software evaluations or the like
US9378108B2 (en) 2007-03-22 2016-06-28 Invention Science Fund I, Llc Implementing performance-dependent transfer or execution decisions from service emulation indications
US10027688B2 (en) 2008-08-11 2018-07-17 Damballa, Inc. Method and system for detecting malicious and/or botnet-related domain names
US8719823B2 (en) * 2009-03-04 2014-05-06 Vmware, Inc. Managing latency introduced by virtualization
US20100229173A1 (en) * 2009-03-04 2010-09-09 Vmware, Inc. Managing Latency Introduced by Virtualization
US10257212B2 (en) 2010-01-06 2019-04-09 Help/Systems, Llc Method and system for detecting malware
US9525699B2 (en) 2010-01-06 2016-12-20 Damballa, Inc. Method and system for detecting malware
US8578497B2 (en) 2010-01-06 2013-11-05 Damballa, Inc. Method and system for detecting malware
US9948671B2 (en) 2010-01-19 2018-04-17 Damballa, Inc. Method and system for network-based detecting of malware from behavioral clustering
US8826438B2 (en) 2010-01-19 2014-09-02 Damballa, Inc. Method and system for network-based detecting of malware from behavioral clustering
US9516058B2 (en) 2010-08-10 2016-12-06 Damballa, Inc. Method and system for determining whether domain names are legitimate or malicious
US8631489B2 (en) 2011-02-01 2014-01-14 Damballa, Inc. Method and system for detecting malicious domain names at an upper DNS hierarchy
US9686291B2 (en) 2011-02-01 2017-06-20 Damballa, Inc. Method and system for detecting malicious domain names at an upper DNS hierarchy
US8949672B1 (en) * 2011-04-18 2015-02-03 Western Digital Technologies, Inc. Analyzing a dump file from a data storage device together with debug history to diagnose/resolve programming errors
US20130007883A1 (en) * 2011-06-28 2013-01-03 Kaspersky Lab Zao Portable Security Device and Methods for Detection and Treatment of Malware
US8863289B2 (en) * 2011-06-28 2014-10-14 Kaspersky Lab Zao Portable security device and methods for detection and treatment of malware
US11599628B2 (en) 2011-09-15 2023-03-07 The Trustees Of Columbia University In The City Of New York Detecting return-oriented programming payloads by evaluating data for a gadget address space address and determining whether operations associated with instructions beginning at the address indicate a return-oriented programming payload
US9495541B2 (en) 2011-09-15 2016-11-15 The Trustees Of Columbia University In The City Of New York Detecting return-oriented programming payloads by evaluating data for a gadget address space address and determining whether operations associated with instructions beginning at the address indicate a return-oriented programming payload
US10192049B2 (en) 2011-09-15 2019-01-29 The Trustees Of Columbia University In The City Of New York Detecting return-oriented programming payloads by evaluating data for a gadget address space address and determining whether operations associated with instructions beginning at the address indicate a return-oriented programming payload
US20130332442A1 (en) * 2012-06-06 2013-12-12 Microsoft Corporation Deep application crawling
US10055762B2 (en) 2012-06-06 2018-08-21 Microsoft Technology Licensing, Llc Deep application crawling
US8990183B2 (en) * 2012-06-06 2015-03-24 Microsoft Technology Licensing, Llc Deep application crawling
US10394212B2 (en) * 2012-06-26 2019-08-27 Inter Control Hermann Kohler Elektrik Gmbh & Co. Kg Apparatus and method for a security-critical application
US10547674B2 (en) 2012-08-27 2020-01-28 Help/Systems, Llc Methods and systems for network flow analysis
US9894088B2 (en) 2012-08-31 2018-02-13 Damballa, Inc. Data mining to identify malicious activity
US9680861B2 (en) 2012-08-31 2017-06-13 Damballa, Inc. Historical analysis to identify malicious activity
US10084806B2 (en) 2012-08-31 2018-09-25 Damballa, Inc. Traffic simulation to identify malicious activity
US9166994B2 (en) 2012-08-31 2015-10-20 Damballa, Inc. Automation discovery to identify malicious activity
US8489925B1 (en) * 2012-11-09 2013-07-16 Kaspersky Lab, Zao System and method for processing of system errors
US8621279B1 (en) * 2012-11-09 2013-12-31 Kaspersky Lab, Zao System and method for generating emulation-based scenarios for Error Handling
US20140172404A1 (en) * 2012-12-14 2014-06-19 Jasen Minov Evaluation of software applications
US9471788B2 (en) * 2012-12-14 2016-10-18 Sap Se Evaluation of software applications
US10025929B2 (en) 2013-03-18 2018-07-17 The Trustees Of Columbia University In The City Of New York Detection of anomalous program execution using hardware-based micro-architectural data
US9996694B2 (en) 2013-03-18 2018-06-12 The Trustees Of Columbia University In The City Of New York Unsupervised detection of anomalous processes using hardware features
WO2014152469A1 (fr) * 2013-03-18 2014-09-25 The Trustees Of Columbia University In The City Of New York Détection de logiciel malveillant reposant sur une anomalie non supervisée à l'aide de caractéristiques de matériel
US10050986B2 (en) 2013-06-14 2018-08-14 Damballa, Inc. Systems and methods for traffic classification
US9262626B2 (en) 2013-12-17 2016-02-16 International Business Machines Corporation Stack entry overwrite protection
US9245110B2 (en) 2013-12-17 2016-01-26 International Business Machines Corporation Stack entry overwrite protection
US20160274997A1 (en) * 2014-01-29 2016-09-22 Hewlett Packard Enterprise Development Lp End user monitoring to automate issue tracking
US9930065B2 (en) 2015-03-25 2018-03-27 University Of Georgia Research Foundation, Inc. Measuring, categorizing, and/or mitigating malware distribution paths
US10430591B1 (en) * 2016-10-04 2019-10-01 Bromium, Inc. Using threat model to monitor host execution in a virtualized environment
US11295021B2 (en) 2016-10-04 2022-04-05 Hewlett-Packard Development Company, L.P. Using a threat model to monitor host execution in a virtualized environment
US10860720B2 (en) 2017-05-23 2020-12-08 Malwarebytes Inc. Static anomaly-based detection of malware files
US10089467B1 (en) 2017-05-23 2018-10-02 Malwarebytes Inc. Static anomaly-based detection of malware files
US20190121686A1 (en) * 2017-10-23 2019-04-25 Liebherr-Werk Nenzing Gmbh Method and system for evaluation of a faulty behaviour of at least one event data generating machine and/or monitoring the regular operation of at least one event data generating machine
US10810073B2 (en) * 2017-10-23 2020-10-20 Liebherr-Werk Nenzing Gmbh Method and system for evaluation of a faulty behaviour of at least one event data generating machine and/or monitoring the regular operation of at least one event data generating machine
US10992703B2 (en) 2019-03-04 2021-04-27 Malwarebytes Inc. Facet whitelisting in anomaly detection
US20220141669A1 (en) * 2020-10-30 2022-05-05 EXFO Solutions SAS SIM swap scam protection via passive monitoring
US12238525B2 (en) * 2020-10-30 2025-02-25 EXFO Solutions SAS SIM swap scam protection via passive monitoring
US20240378290A1 (en) * 2023-05-11 2024-11-14 International Business Machines Corporation Detecting a security bypass through binary code analysis

Also Published As

Publication number Publication date
US20140215276A1 (en) 2014-07-31
CA2626993A1 (fr) 2007-05-03
US20190250979A1 (en) 2019-08-15
US20220058077A1 (en) 2022-02-24
US20100023810A1 (en) 2010-01-28
US20160246665A1 (en) 2016-08-25
US20190250978A1 (en) 2019-08-15
WO2007050667A2 (fr) 2007-05-03
WO2007050667A3 (fr) 2009-04-30
US20120151270A1 (en) 2012-06-14
EP1952240A2 (fr) 2008-08-06
US20210096941A1 (en) 2021-04-01
US8601322B2 (en) 2013-12-03

Similar Documents

Publication Publication Date Title
US20220058077A1 (en) Methods, media, and systems for detecting anomalous program executions
US11106799B2 (en) Methods, media, and systems for detecting an anomalous sequence of function calls
US7490268B2 (en) Methods and systems for repairing applications
Cheng et al. Orpheus: Enforcing cyber-physical execution semantics to defend against data-oriented attacks
US9218254B2 (en) Systems, methods, and media for recovering an application from a fault or attack
Choudhari et al. SpecDefender: Transient execution attack defender using performance counters
Zhou et al. Hardware-based on-line intrusion detection via system call routine fingerprinting
Zhu et al. Jintide: Utilizing low-cost reconfigurable external monitors to substantially enhance hardware security of large-scale CPU clusters
Locasto et al. From STEM to SEAD: Speculative execution for automated defense
Alonso et al. Special session: Security and ras in the computing continuum
Alonso García et al. Security and RAS in the computing continuum
Martı Alonso et al. Security and RAS in the Computing Continuum

Legal Events

Date Code Title Description
AS Assignment

Owner name: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:STOLFO, SALVATORE J;KEROMYTIS, ANGELOS D;SIDIROGLOU, STYLIANOS;REEL/FRAME:021507/0369;SIGNING DATES FROM 20080801 TO 20080807

Owner name: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:STOLFO, SALVATORE J;KEROMYTIS, ANGELOS D;SIDIROGLOU, STYLIANOS;SIGNING DATES FROM 20080801 TO 20080807;REEL/FRAME:021507/0369

STCF Information on status: patent grant

Free format text: PATENTED CASE

IPR Aia trial proceeding filed before the patent and appeal board: inter partes review

Free format text: TRIAL NO: IPR2015-00375

Opponent name: SYMANTEC CORPORATION

Effective date: 20141205

FPAY Fee payment

Year of fee payment: 4

STCV Information on status: appeal procedure

Free format text: APPLICATION INVOLVED IN COURT PROCEEDINGS

AS Assignment

Owner name: NATIONAL SCIENCE FOUNDATION, VIRGINIA

Free format text: CONFIRMATORY LICENSE;ASSIGNOR:COLUMBIA UNIVERSITY;REEL/FRAME:040492/0407

Effective date: 20161018

CC Certificate of correction
IPRC Trial and appeal board: inter partes review certificate

Kind code of ref document: K1

Free format text: INTER PARTES REVIEW CERTIFICATE; TRIAL NO. IPR2015-00375, DEC. 5, 2014INTER PARTES REVIEW CERTIFICATE FOR PATENT 8,074,115, ISSUED DEC. 6, 2011, APPL. NO. 12/091,150, JUN. 15, 2009INTER PARTES REVIEW CERTIFICATE ISSUED JAN. 10, 2019

Effective date: 20190110

IPRC Trial and appeal board: inter partes review certificate

Kind code of ref document: K1

Free format text: INTER PARTES REVIEW CERTIFICATE; TRIAL NO. IPR2015-00375, DEC. 5, 2014 INTER PARTES REVIEW CERTIFICATE FOR PATENT 8,074,115, ISSUED DEC. 6, 2011, APPL. NO. 12/091,150, JUN. 15, 2009 INTER PARTES REVIEW CERTIFICATE ISSUED JAN. 10, 2019

Effective date: 20190110

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2553); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

Year of fee payment: 12